Bug 355399 – =dev-lang/php-5.3.5: grapheme_extract() NULL Pointer Dereference (CVE-2011-0420)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Paweł Hajdan, Jr. (RETIRED) 2011-02-18 09:17:49 UTC]

- --- 0.Description ---
Internationalization extension (further is referred as Intl) is a wrapper
for ICU library, enabling PHP programmers to perform UCA-conformant
collation and date/time/number/currency formatting in their scripts.

grapheme_extract — Function to extract a sequence of default grapheme
clusters from a text buffer, which must be encoded in UTF-8.

- --- 3. Fix ---
CVS
http://svn.php.net/viewvc?view=revision&revision=306449

[Comment 1 GLSAMaker/CVETool Bot 2011-06-24 00:31:23 UTC]

CVE-2011-0420 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0420):
  The grapheme_extract function in the Internationalization extension (Intl)
  for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial
  of service (crash) via an invalid size argument, which triggers a NULL
  pointer dereference.

[Comment 2 Tobias Heinlein (RETIRED) 2011-10-10 21:41:33 UTC]

This issue was resolved and addressed in
 GLSA 201110-06 at http://security.gentoo.org/glsa/glsa-201110-06.xml
by GLSA coordinator Tobias Heinlein (keytoaster).