CVE-2017-11362
CriticalSummary
In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, the msgfmt_parse_message function in msgformat_parse.c does not restrict locale length, which can lead to stack-based buffer overflow and application crash.
Risk Assessment
Remote attackers may exploit this vulnerability to cause denial of service, potentially affecting the availability of applications using ICU.
Recommendation
It is recommended to upgrade PHP to version 7.0.21 or 7.1.7 and to monitor applications for unauthorized attempts to exploit this vulnerability.
Original NVD description (English source)
In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.