Statement on glibc/iconv Vulnerability

EDIT 2024-04-25: Clarified when a PHP application is vulnerable to this bug. Recently, a bug in version 2.39 and older () was uncovered where a buffer overflow in character set conversions the ISO-2022-CN-EXT character set can result in remote code execution. glibc CVE-2024-2961 to This specific buffer overflow in glibc is exploitable through PHP, which exposes the iconv functionality of glibc to do character set conversions via the . Although the bug is exploitable in the context of the PHP Engine, the bug is not in PHP. It is also not directly exploitable remotely. iconv extension The bug i…

PHP Newsで読む

2024/04/25 03:40、PHP Newsが「Statement on glibc/iconv Vulnerability」を公開しました (種別: リリース・告知)。関連する技術: PHP、C / C++。CVE: CVE-2024-2961。