CVE-2014-9912
CriticalSummary
The get_icu_disp_value_src_php function in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which may lead to denial of service (buffer overflow) or other unspecified impacts.
Risk Assessment
Remote attackers may exploit this vulnerability to trigger a buffer overflow, potentially causing system crashes or other unforeseen effects, jeopardizing application stability.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and implement additional security measures to restrict access to localization-related functions.
Original NVD description (English source)
The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.