Buffer overflow in icu - security update
Summary
DLA-615-1: icu - security update. Affects icu versions < 4.8.1.1-12+deb7u5. Fixed in 4.8.1.1-12+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ICU (International Components for Unicode) is a C and C++ library that provides robust and full-featured Unicode support. It is widely used in various applications and operating systems. The icu package in Debian Wheezy is vulnerable to a buffer overflow in the uloc_acceptLanguageFromHTTP function.
Vulnerability Detail
The uloc_acceptLanguageFromHTTP function in ICU is susceptible to a buffer overflow. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial of service. The buffer overflow occurs when the function processes a specially crafted HTTP Accept-Language header. By sending a malicious header, an attacker can overwrite adjacent memory and potentially gain control over the affected system.
How To Fix
Minimum fixed version
4.8.1.1-12+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade icuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk.
Conclusion
The buffer overflow vulnerability in the icu package can lead to arbitrary code execution or denial of service. To protect your system, it is crucial to apply the recommended security update. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for icu →
FAQ
ICU (International Components for Unicode) is a C and C++ library that provides robust and full-featured Unicode support. It is used in various applications and operating systems.
The uloc_acceptLanguageFromHTTP function is a part of ICU library that processes the Accept-Language header in HTTP requests. It determines the preferred language for the user based on the header value.
An attacker can exploit this vulnerability by sending a specially crafted HTTP Accept-Language header to a vulnerable application that uses the ICU library. By overwriting adjacent memory, the attacker can execute arbitrary code or cause a denial of service.
The impact of this vulnerability can vary depending on the context in which the vulnerable application is used. In worst-case scenarios, an attacker could gain control over the affected system and potentially access sensitive information or disrupt services.
Yes, a fix is available for this vulnerability. It is recommended to upgrade the icu package to version 4.8.1.1-12+deb7u5 or later to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for icu.
