CVE-2010-4409
PHP < 5.3.3 - Denial of Service via NumberFormatter::getSymbol Integer Overflow
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-4409. PoCs published by Maksymilian Arciemowicz.
AI-analyzed exploit summary The exploit demonstrates an integer overflow vulnerability in PHP 5.3.3's NumberFormatter::getSymbol function, leading to a segmentation fault due to improper handling of large integer values. The PoC triggers a crash by passing an excessively large integer (e.g., 2147483648) to the function, causing a buffer overflow in the ICU library's UnicodeString::extract method.
Description
Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument.
Exploits (1)
The exploit demonstrates an integer overflow vulnerability in PHP 5.3.3's NumberFormatter::getSymbol function, leading to a segmentation fault due to improper handling of large integer values. The PoC triggers a crash by passing an excessively large integer (e.g., 2147483648) to the function, causing a buffer overflow in the ICU library's UnicodeString::extract method.