CVE-2017-17484

Critical

Published: 10/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The ucnv_UTF8FromUTF8 function in the ICU library for C/C++ through version 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which can lead to stack-based buffer overflow and application crash.

Risk Assessment

Remote attackers may exploit this vulnerability to cause denial of service, impacting the availability of applications within the organization.

Recommendation

It is recommended to update the ICU library to the latest version to mitigate this vulnerability and to monitor applications for unauthorized calls.

Original NVD description (English source)

The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.