CVE-2018-18928
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
Risk Assessment
The integer overflow may lead to incorrect numeric data processing, application crashes, or other undefined behavior in programs using ICU.
Recommendation
Update ICU for C/C++ to a version containing the fix for this issue.
Other vulnerabilities in International Components for Unicode (ICU)
See all- CVE-2017-7868High
In ICU versions for C/C++ before 2017-02-13, there is an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function and the utext_moveIndex32 functions.
- CVE-2017-7867High
International Components for Unicode (ICU) for C/C++ before February 13, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function and the utext_setNativeIndex* functions.
- CVE-2015-5922High
Unspecified vulnerability in International Components for Unicode (ICU) before version 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2.
- CVE-2017-17484Critical
The ucnv_UTF8FromUTF8 function in the ICU library for C/C++ through version 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which can lead to stack-based buffer overflow and application crash.
- CVE-2014-9911Critical
A stack-based buffer overflow in the ures_getByKeyWithFallback function in ICU before version 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.
- CVE-2016-7415Critical
A stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through version 57.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
Original NVD description (English source)
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS