CVE-2014-9912: Buffer Overflow

Q: What is the severity of CVE-2014-9912?

CVE-2014-9912 has a severity rating of medium due to its potential to cause denial of service or a buffer overflow.

Q: How do I fix CVE-2014-9912?

To fix CVE-2014-9912, update PHP to version 5.3.29, 5.4.30, or 5.5.14 or later.

Q: Which versions of PHP are affected by CVE-2014-9912?

CVE-2014-9912 affects PHP versions before 5.3.29, all 5.4.x versions before 5.4.30, and all 5.5.x versions before 5.5.14.

Q: What types of attacks can exploit CVE-2014-9912?

CVE-2014-9912 can be exploited to perform denial of service attacks, potentially leading to application crashes.

Q: Is there a workaround for CVE-2014-9912?

The best approach for CVE-2014-9912 is upgrading to the fixed versions, as no effective workaround is provided.

Published Jan 4, 2017

Updated

The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a localegetdisplayname call with a long first argument.

Affected Software

62 affected components

PHP PHP<=5.3.28

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16-rc1

PHP PHP=5.4.17

PHP PHP=5.4.18

PHP PHP=5.4.19

PHP PHP=5.4.20

PHP PHP=5.4.21

PHP PHP=5.4.22

PHP PHP=5.4.23

PHP PHP=5.4.24

PHP PHP=5.4.25

PHP PHP=5.4.26

PHP PHP=5.4.27

PHP PHP=5.4.28

PHP PHP=5.4.29

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

Remediation

Patch Available

https://bugs.php.net/bug.php?id=67397

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=1383569

Event History

Jan 4, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9912?

CVE-2014-9912 has a severity rating of medium due to its potential to cause denial of service or a buffer overflow.

How do I fix CVE-2014-9912?

To fix CVE-2014-9912, update PHP to version 5.3.29, 5.4.30, or 5.5.14 or later.

Which versions of PHP are affected by CVE-2014-9912?

CVE-2014-9912 affects PHP versions before 5.3.29, all 5.4.x versions before 5.4.30, and all 5.5.x versions before 5.5.14.

What types of attacks can exploit CVE-2014-9912?

CVE-2014-9912 can be exploited to perform denial of service attacks, potentially leading to application crashes.

Is there a workaround for CVE-2014-9912?

The best approach for CVE-2014-9912 is upgrading to the fixed versions, as no effective workaround is provided.

CVE-2014-9912: Buffer Overflow

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2014-9912?

How do I fix CVE-2014-9912?

Which versions of PHP are affected by CVE-2014-9912?

What types of attacks can exploit CVE-2014-9912?

Is there a workaround for CVE-2014-9912?

Company

Resources

Contact