Servers and applications
CVE-2014-9912 The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.
Severity Critical 9.8
Published 4 Jan 2017
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.5.13 Version 5.5.12 Version 5.5.11 Version 5.5.10 All 62 release lines Every version up to 5.3.28 Version 5.4.0 Version 5.4.1 Version 5.4.2 Version 5.4.3 Version 5.4.4 Version 5.4.5 Version 5.4.6 Version 5.4.7 Version 5.4.8 Version 5.4.9 Version 5.4.10 Version 5.4.11 Version 5.4.12-rc1 Version 5.4.12-rc2 Version 5.4.12 Version 5.4.13-rc1 Version 5.4.13 Version 5.4.14-rc1 Version 5.4.14 Version 5.4.15-rc1 Version 5.4.15 Version 5.4.16-rc1 Version 5.4.17 Version 5.4.18 Version 5.4.19 Version 5.4.20 Version 5.4.21 Version 5.4.22 Version 5.4.23 Version 5.4.24 Version 5.4.25 Version 5.4.26 Version 5.4.27 Version 5.4.28 Version 5.4.29 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13
References NVD https://nvd.nist.gov/vuln/detail/CVE-2014-9912 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-9912