PHP 5.3.x 'Intl' Extension - 'NumberFormatter::setSymbol()' Denial of Service

Author: thoger
type: dos
platform: php
port: 0
date_added: 2011-03-10
date_updated: 2014-12-08
verified: 1
codes: CVE-2011-1467;OSVDB-73625
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/46968/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Intl' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

PHP versions prior to 5.3.6 are vulnerable.

numfmt_set_symbol(numfmt_create("en", NumberFormatter::PATTERN_DECIMAL), 2147483648, "")