Critical Out-of-Bounds Read Vulnerability in ICU Package
Summary
ALPINE-CVE-2016-6293: The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, whi... Affects icu versions < 57.1-r1. Fixed in 57.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The International Components for Unicode (ICU) is a mature, widely-used set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. ICU enables developers to handle text in a variety of languages and formats, ensuring proper localization and internationalization. However, versions of ICU up to 57.1 have been found to contain a critical vulnerability that can lead to denial of service and potential data exposure.
Vulnerability Detail
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in ICU versions up to 57.1 does not ensure that a '\0' character is present at the end of a temporary array. This oversight allows remote attackers to exploit the function by sending a long httpAcceptLanguage argument, leading to an out-of-bounds read. The ramifications of this vulnerability include potential denial of service and the risk of exposing sensitive information, making it a critical security concern with a CVSS score of 9.8.
How To Fix
Minimum fixed version
57.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade icuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the input length of the httpAcceptLanguage argument in your application to prevent exploitation until the package is updated. Ensure that any input is validated and sanitized before processing.
Conclusion
The ICU package has a critical vulnerability that can lead to severe security issues if not addressed. Updating to the patched version is essential for maintaining the integrity and security of applications using this library. Regular monitoring for vulnerabilities using tools like Vulert can help ensure that your software remains secure.
See every vulnerability recorded for icu →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
All versions of ICU up to and including 57.1 are affected by this vulnerability.
The vulnerability can lead to denial of service and may expose sensitive information through out-of-bounds reads.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement input validation to restrict the length of the httpAcceptLanguage argument as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for icu.
