Iconv, set the charset to RCE: exploiting the glibc to hack the PHP engine

No ratings

Presented at DEFCON 23 by

Charles Fol

Upon its discovery, CVE-2024-2961, a very old buffer overflow in the glibc, seemed like a terrible bug. Within the prism of the PHP engine, however, the vulnerability shone, and provided both a new remote code execution vector and a few 0-days.