CVE-2014-9911

Critical

Published: 04/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A stack-based buffer overflow in the ures_getByKeyWithFallback function in ICU before version 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Risk Assessment

The organization may experience a denial of service, leading to service availability interruptions. Additionally, there is a risk of unspecified impacts that could affect system integrity.

Recommendation

It is recommended to update the ICU library to version 54.1 or later to mitigate this vulnerability. Also, monitor systems for unauthorized attempts to exploit this vulnerability.

Original NVD description (English source)

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.