Re: CVE-2007-4840
| From: | sean finney | Date: | Tue, 18 Sep 2007 20:52:04 +0000 |
| Subject: | Re: CVE-2007-4840 | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-32371@lists.php.net to get a copy of this message | ||
On Tuesday 18 September 2007 09:54:05 pm Stanislav Malyshev wrote:
> > i'm just going through the latest batch of CVE's and it doesn't look like
> > there's a fix for CVE-2007-4840 yet:
>
> It's funny that glibc bug gets listed as PHP issue. But I think we may
> impose limit on charset length for iconv.
ah, so it's a glibc issue then? istr a similar thing come up with truetype
fonts that ended up being a bug in the tr1 lib, but because the PoC used php
it was classified as a php vulnerabity. if it's the same case here then i
think the onus is on glibc...
/me goes to r some tfm and headers...
sean
Attachment: [application/pgp-signature] This is a digitally signed message part. signature.asc
Attachment: [application/pgp-signature] This is a digitally signed message part. signature.asc