Description
The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.
Remediation
References
Related Vulnerabilities
WordPress Plugin Add Link to Facebook Multiple Cross-Site Scripting Vulnerabilities (1.215)
PHP Use After Free Vulnerability (CVE-2014-3622)
Werkzeug WSGI Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2023-25577)
Oracle HTTP Server Integer Overflow or Wraparound Vulnerability (CVE-2022-25315)