# SECURITY: bug in PHP/GLIBC that impacts any Dolibarr installation

**URL:** <https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252>\
**Category:** Maintaining my Dolibarr\
**Tags:** Security, Linux, Issue\
**Created:** [April 24, 2024, 5:38am UTC](https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252 "2024-04-24T05:38:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonbendtsen](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/977dab/32.png) [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\
**Post date:** [April 24, 2024, 5:38am UTC](https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252/1 "2024-04-24T05:38:27Z")

</div>

Hey

Allegedly there is a bug in GLIBC that impacts PHP which impacts any Dolibarr installation on Linux, and there are hints that it might be remotely exploitable just by sending an HTTP header which you can do even before logging in.

If you can upgrade GLIBC (to something new enough) you should do that, but there is also another method which might be worth doing anyway because the mitigation probably does not cause any trouble for most of you.

It is all related to CN-EXT which is an extension to Chinese character set ISO-2022-CN, so my guess is that the mitigation has no impact for most of you.

On your Dolibarr installation on Linux, any Linux, any Dolibarr, run these commands:

1. **iconv -l | grep -i CN | grep -i EXT**

and you should get a line like this: **ISO-2022-CN-EXT//**

1. **find / -iname gconv**

I got this output: **/usr/lib/x86\_64-linux-gnu/gconv**

1. **cd /usr/lib/x86\_64-linux-gnu/gconv**

2. **ls -la gconv-modules**

3. **cp gconv-modules backup.gconv-modules**

4. edit gconv-modules and put # infront of the lines with CN EXT which in my case is this result

> #alias ISO2022CNEXT// ISO-2022-CN-EXT//  
> #module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1  
> #module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT

1. run the command **iconvconfig**

2. check that the change was made by running the command from #1 again  
**iconv -l | grep -i CN | grep -i EXT**  
and you should get NO output

3. that should be it, I got the mitigation from “thenickdude” here [https://www.reddit.com/r/PHP/comments/1c9lslg/comment/l0o3tp2/?rdt=35527](https://www.reddit.com/r/PHP/comments/1c9lslg/comment/l0o3tp2/?rdt=35527)

10, maybe watch this less than 9 minute video

[![](https://img.youtube.com/vi/u8jLUjpCWrs/maxresdefault.jpg "All PHP Applications are Vulnerable") ](https://www.youtube.com/watch?v=u8jLUjpCWrs)

---

<div class="post-metadata">

**Author:** ![libremaster](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/libremaster/32/8686_2.png) [@libremaster](https://www.dolibarr.org/forum/u/libremaster)\
**Post date:** [April 24, 2024, 7:43am UTC](https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252/2 "2024-04-24T07:43:48Z")

</div>

And if you are a pro with sysadmin, (never modify your system directly), you can check your system :

**Debian 12:**

```auto
dpkg -l | grep libc6

```

You should see : 2.36-9+deb12u6  
([Debian -- Details of package libc6 in bookworm](https://packages.debian.org/bookworm/libc6))

**Ubuntu jammy:**

```auto
dpkg -l | grep libc6

```

You should see : 2.35-0ubuntu3.7  
([https://changelogs.ubuntu.com/changelogs/pool/main/g/glibc/glibc\_2.35-0ubuntu3.7/changelog](https://changelogs.ubuntu.com/changelogs/pool/main/g/glibc/glibc_2.35-0ubuntu3.7/changelog))

**And you can update your system (debian or ubuntu) :**

```auto
apt update
apt upgrade

```

---

<div class="post-metadata">

**Author:** ![jonbendtsen](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/977dab/32.png) [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\
**Post date:** [April 24, 2024, 8:56am UTC](https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252/3 "2024-04-24T08:56:14Z")

</div>

1. It might not always be possible to update your system
2. Even if it is possible to update, there might not be a new glibc package available
3. Even if a glibc package is available it might be for other reasons than fixing this bug