## Statement on glibc/iconv Vulnerability

- 種別: release
- 関連技術: php, cpp
- CVE: CVE-2024-2961
- 公開日時: 2024-04-24T18:40:29.000Z
- 情報源: PHP News (https://www.php.net/index.php#2024-04-24-1)
- パーマリンク: https://vulnpulse.app/items/php-news-7a5ca541a1a3

EDIT 2024-04-25: Clarified when a PHP application is vulnerable to this bug. Recently, a bug in version 2.39 and older () was uncovered where a buffer overflow in character set conversions the ISO-2022-CN-EXT character set can result in remote code execution. glibc CVE-2024-2961 to This specific buffer overflow in glibc is exploitable through PHP, which exposes the iconv functionality of glibc to do character set conversions via the . Although the bug is exploitable in the context of the PHP Engine, the bug is not in PHP. It is also not directly exploitable remotely. iconv extension The bug i…