Re: CVE request (PHP 5.3.x getSymbol() DoS; CERT VU#479900)

[Tomas Hoger <thoger () redhat com>]

On Mon, 6 Dec 2010 10:15:28 -0700 Vincent Danen wrote:

> CERT has a bulletin up regarding a DoS in the getSymbol() function
> (integer overflow vulnerability):
>
> http://www.kb.cert.org/vuls/id/479900
> http://svn.php.net/viewvc?view=revision&revision=305571
> http://php.net/manual/en/numberformatter.getsymbol.php

Btw, setSymbol() is affected too, and does not seem to be addressed in
r305571.  In both cases, it's PHP exposing ICU bug.

-- 
Tomas Hoger / Red Hat Security Response Team