CVE-2018-10546: High severity PHP PHP vulnerability
An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources.
Other sources
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
Fixed bug (stream filter convert.iconv leads to infinite loop on invalid sequence). (CVE-2018-10546)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.6.36 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.30 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.17 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.5 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.30 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.5-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.1.17-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Patch 06d309fd7a917575d65c7a6f4f57b0e6bb0f9711
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10546?
CVE-2018-10546 is considered a moderate severity vulnerability due to its potential to hang the PHP process.
How do I fix CVE-2018-10546?
To mitigate CVE-2018-10546, upgrade to PHP versions 5.6.36, 7.0.30, 7.1.17, or 7.2.5.
What systems are affected by CVE-2018-10546?
CVE-2018-10546 affects PHP versions prior to 5.6.36, 7.0.x before 7.0.30, and 7.1.x before 7.1.30.
Can CVE-2018-10546 be exploited remotely?
Yes, CVE-2018-10546 can be exploited by remote attackers to cause the PHP process to hang.
What specific files are impacted by CVE-2018-10546?
CVE-2018-10546 is related to an issue in the ext/iconv/iconv.c file in PHP.