{"id":"CVE-2014-9912","aliases":["EUVD-2014-9717","GHSA-283g-59hf-7q7h","SUSE-SU-2017:0109-1","UBUNTU-CVE-2014-9912","USN-3196-1"],"status":"published","title":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29,...","description":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04948,"percentile":0.92212,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-01-04T00:00:00Z","modified":"2026-06-17T00:19:12Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.21"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-94.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-94.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-94.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.21"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.21"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20"],"bundled":10}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"http://www.securityfocus.com/bid/68549","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1383569","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2016/11/25/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory"]},{"url":"http://www.php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://bugs.php.net/bug.php?id=67397","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9912"},{"url":"https://github.com/advisories/GHSA-283g-59hf-7q7h"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170109-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012232","tags":["report"]},{"url":"https://bugzilla.suse.com/1015187","tags":["report"]},{"url":"https://bugzilla.suse.com/1015188","tags":["report"]},{"url":"https://bugzilla.suse.com/1015189","tags":["report"]},{"url":"https://bugzilla.suse.com/974305","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9935","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9912","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=148003512008712\u0026w=2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3196-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10161","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9912","description":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","status":"published","published":"2017-01-04T20:00:00Z","modified":"2024-08-06T14:02:36.642Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9717","description":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","status":"published","published":"2017-01-04T20:00:00Z","modified":"2024-08-06T14:02:36Z","updated_at":"2026-11-03T01:56:47.514809Z"}],"ghsa":[{"id":"GHSA-283g-59hf-7q7h","title":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29,...","description":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","status":"published","published":"2022-05-17T03:05:47Z","modified":"2023-01-27T05:06:11Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:42:51.492706Z"}],"nvd":[{"id":"CVE-2014-9912","description":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","status":"published","published":"2017-01-04T20:59:00.217Z","modified":"2026-06-17T00:19:12.413Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"UBUNTU-CVE-2014-9912","description":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","status":"published","published":"2017-01-04T00:00:00Z","modified":"2026-04-22T10:00:36.207508Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"SUSE-SU-2017:0109-1","title":"Security update for php53","description":"\nThis update for php53 fixes the following issues:\n\n* CVE-2014-9912: Stack-based buffer overflow in uloc_getDisplayName() [bsc#1012232]\n* CVE-2016-9933: Possible stack overflow on truecolor images handling [bsc#1015187]\n* CVE-2016-9934: Dereference from NULL pointer could lead to crash [bsc#1015188]\n* CVE-2016-9935: Invalid read could lead to crash [bsc#1015189]\n* Buffer overflow in libmagic, allowing attackers to crash the PHP interpreter [bsc#974305]\n","status":"published","published":"2017-01-11T16:32:03Z","modified":"2026-02-04T03:06:38.136841Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3196-1","title":"php5 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain arguments to the\nlocale_get_display_name function. A remote attacker could use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2014-9912)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\nhang, resulting in a denial of service. (CVE-2016-7478)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only applied to Ubuntu 14.04 LTS. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-9934)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n","status":"published","published":"2017-02-14T18:44:56Z","modified":"2026-04-22T09:31:26.707533Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}