{"id":"php-news-7a5ca541a1a3","seq":478,"kind":"release","title":"Statement on glibc/iconv Vulnerability","url":"https://www.php.net/index.php#2024-04-24-1","permalink":"https://vulnpulse.app/items/php-news-7a5ca541a1a3","summary":"EDIT 2024-04-25: Clarified when a PHP application is vulnerable to this bug. Recently, a bug in version 2.39 and older () was uncovered where a buffer overflow in character set conversions the ISO-2022-CN-EXT character set can result in remote code execution. glibc CVE-2024-2961 to This specific buffer overflow in glibc is exploitable through PHP, which exposes the iconv functionality of glibc to do character set conversions via the . Although the bug is exploitable in the context of the PHP Engine, the bug is not in PHP. It is also not directly exploitable remotely. iconv extension The bug i…","severity":null,"techs":["php","cpp"],"cves":["CVE-2024-2961"],"tags":["security"],"source":{"id":"php-news","name":"PHP News"},"published_at":"2024-04-24T18:40:29.000Z","fetched_at":"2026-10-21T16:17:45.625Z"}