CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

CVE-2017-16654

CVE-2017-16654 (Symfony Directory Traversal) : The Symfony Intl component in affected lines (before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, 4.0-BETA5) uses bundle readers to load resource bundles from the local filesystem. The read() methods take a locale, which can be supplied from untrusted ...

CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

CVE-2017-16654: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

Fedora 27 : php (2018-04f6056c42)

PHP version 7.1.17 26 Apr 2018 Date: - Fixed bug php76131 mismatch arginfo for datecreate. carusogabriel Exif: - Fixed bug php76130 Heap Buffer Overflow READ: 1786 in exifiifaddvalue. Stas FPM: - Fixed bug php68440 ERROR: failed to reload: execvp failed: Argument list too long. Jacob Hipps - Fixe...

Fedora 26 : php (2018-6071a600e8)

PHP version 7.1.17 26 Apr 2018 Date: - Fixed bug php76131 mismatch arginfo for datecreate. carusogabriel Exif: - Fixed bug php76130 Heap Buffer Overflow READ: 1786 in exifiifaddvalue. Stas FPM: - Fixed bug php68440 ERROR: failed to reload: execvp failed: Argument list too long. Jacob Hipps - Fixe...

chakra: Stack-use-after-scope in char16_t const* PlatformAgnostic::Intl::FormatNumber<int>

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=6197060945575936 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Stack-use-after-scope READ 3 Crash Address: 0x7f3d2ffda0c0 Crash State: char16t const...

Fedora 27 : php (2017-46e8bdccef)

PHP version 7.1.11 26 Oct 2017 Core: - Fixed bug php75241 NULL pointer dereference in zendmmallocsmall. Laruence - Fixed bug php75236 infinite loop when printing an error-message. Andrea - Fixed bug php75252 Incorrect token formatting on two parse errors in one request. Nikita - Fixed bug php7522...

chakra: Stack-use-after-scope in char16_t const* PlatformAgnostic::Intl::FormatNumber<double>

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5972830278647808 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Stack-use-after-scope READ 3 Crash Address: 0x7f9ca422b8c0 Crash State: char16t const...

PT-2017-3873

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.7.38 Symfony versions prior to 2.8.31 Symfony versions prior to 3.2.14 Symfony versions prior to 3.3.13 Symfony versions prior to 3.4-BETA5 Symfony versions prior to 4.0-BETA5 Description An issue in the Intl...

CVE-2017-16654: Intl bundle readers breaking out of paths

Affected versions Symfony 2.7.0 to 2.7.37, 2.8.0 to 2.8.30, 3.2.0 to 3.2.13, and 3.3.0 to 3.3.12 versions of the Symfony Intl component are affected by this security issue. The issue has been fixed in Symfony 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. Note that no fixes are provide...

CVE-2017-16654: Intl bundle readers breaking out of paths

More info at https://symfony.com/cve-2017-16654...

Fedora 25 : php (2017-cdaaf6ea12)

PHP version 7.0.25 26 Oct 2017 Core: - Fixed bug php75241 NULL pointer dereference in zendmmallocsmall. Laruence - Fixed bug php75236 infinite loop when printing an error-message. Andrea - Fixed bug php75252 Incorrect token formatting on two parse errors in one request. Nikita - Fixed bug php7522...

CVE-2017-11362

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformatparse.c does not restrict the locale length, which allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact within International...

CVE-2017-11362: Improper Restriction of Operations within the Bounds of a Memory Buffer

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformatparse.c does not restrict the locale length, which allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact within International...

Apple Safari - DateTimeFormat.format Type Confusion Exploit

Exploit for multiple platform in category dos / poc var date = new DateDate.UTC2012, 11, 20, 3, 0, 0; var i = new Intl.DateTimeFormat; //printi; var q; function f //print"in f"; //printf.caller; q = f.caller; return 10; try i.formatvalueOf : f; catche //print"problem"; //printq; q.call0x77777777;...

Apple Safari - DateTimeFormat.format Type Confusion

Apple Safari - DateTimeFormat.format Type Confusion var date = new DateDate.UTC2012, 11, 20, 3, 0, 0; var i = new Intl.DateTimeFormat; //printi; var q; function f //print"in f"; //printf.caller; q = f.caller; return 10; try i.formatvalueOf : f; catche //print"problem"; //printq; q.call0x77777777;...

CVE-2014-9912

The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...

CVE-2014-9912: Improper Restriction of Operations within the Bounds of a Memory Buffer

The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service buffer overflow or possibly have...

Microsoft Edge - Internationalization Initialization Type Confusion (MS16-144)

1; , set: function ; function f var i = Intl; Intl = ; // this somehow prevents an exception that prevents laoding di, "Collator", noobj; Object.defineProperty = f; var q = new Intl.NumberFormat"en";...