CVE-2017-7868
HighSummary
In ICU versions for C/C++ before 2017-02-13, there is an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function and the utext_moveIndex32 functions.
Risk Assessment
This vulnerability may lead to unauthorized memory access, potentially resulting in data leakage or application crashes.
Recommendation
It is recommended to update ICU to version 2017-02-13 or later to mitigate this vulnerability.
Other vulnerabilities in International Components for Unicode (ICU)
See all- CVE-2017-7867High
International Components for Unicode (ICU) for C/C++ before February 13, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function and the utext_setNativeIndex* functions.
- CVE-2015-5922High
Unspecified vulnerability in International Components for Unicode (ICU) before version 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2.
- CVE-2017-17484Critical
The ucnv_UTF8FromUTF8 function in the ICU library for C/C++ through version 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which can lead to stack-based buffer overflow and application crash.
- CVE-2014-9911Critical
A stack-based buffer overflow in the ures_getByKeyWithFallback function in ICU before version 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.
- CVE-2016-7415Critical
A stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through version 57.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
Original NVD description (English source)
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.