CVE-2017-17484
CriticalSummary
The ucnv_UTF8FromUTF8 function in the ICU library for C/C++ through version 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which can lead to stack-based buffer overflow and application crash.
Risk Assessment
Remote attackers may exploit this vulnerability to cause denial of service, impacting the availability of applications within the organization.
Recommendation
It is recommended to update the ICU library to the latest version to mitigate this vulnerability and to monitor applications for unauthorized calls.
Other vulnerabilities in International Components for Unicode (ICU)
See all- CVE-2017-7868High
In ICU versions for C/C++ before 2017-02-13, there is an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function and the utext_moveIndex32 functions.
- CVE-2017-7867High
International Components for Unicode (ICU) for C/C++ before February 13, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function and the utext_setNativeIndex* functions.
- CVE-2015-5922High
Unspecified vulnerability in International Components for Unicode (ICU) before version 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2.
- CVE-2014-9911Critical
A stack-based buffer overflow in the ures_getByKeyWithFallback function in ICU before version 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.
- CVE-2016-7415Critical
A stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through version 57.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
Original NVD description (English source)
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.