最新のセキュリティ情報
4月25日(木)
Statement on glibc/iconv Vulnerability
EDIT 2024-04-25: Clarified when a PHP application is vulnerable to this bug. Recently, a bug in version 2.39 and older () was uncovered where a buffer overflow in character set conversions the ISO-2022-CN-EXT character set can result in remote code execution. glibc CVE-2024-2961 to This specific buffer overflow in glibc is exploitable through PHP, which exposes the iconv functionality of glibc to do character set conversions via the . Although the bug is exploitable in the context of the PHP Engine, the bug is not in PHP. It is also not directly exploitable remotely. iconv extension The bug i…