CVE-2018-10546: High severity php vulnerability
An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources.
Other sources
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
Fixed bug (stream filter convert.iconv leads to infinite loop on invalid sequence). (CVE-2018-10546)
— PHP
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10546?
CVE-2018-10546 is considered a moderate severity vulnerability due to its potential to hang the PHP process.
How do I fix CVE-2018-10546?
To mitigate CVE-2018-10546, upgrade to PHP versions 5.6.36, 7.0.30, 7.1.17, or 7.2.5.
What systems are affected by CVE-2018-10546?
CVE-2018-10546 affects PHP versions prior to 5.6.36, 7.0.x before 7.0.30, and 7.1.x before 7.1.30.
Can CVE-2018-10546 be exploited remotely?
Yes, CVE-2018-10546 can be exploited by remote attackers to cause the PHP process to hang.
What specific files are impacted by CVE-2018-10546?
CVE-2018-10546 is related to an issue in the ext/iconv/iconv.c file in PHP.