CVE-2016-6294: Out-of-bounds Read

The localeacceptfromhttp function in ext/intl/locale/localemethods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU ulocacceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service out-of-bounds read or...