Buffer Overflow Vulnerabilities in icu Package
Summary
DLA-744-1: icu - security update. Affects icu versions < 4.8.1.1-12+deb7u6. Fixed in 4.8.1.1-12+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The icu package is a library that provides Unicode and Globalization support for software applications. It is commonly used in various programming languages and operating systems. This package is vulnerable to two buffer overflow vulnerabilities, namely CVE-2014-9911 and CVE-2016-7415.
Vulnerability Detail
CVE-2014-9911 is a buffer overflow vulnerability that allows remote attackers to cause a denial of service or potentially execute arbitrary code by exploiting a buffer overflow in crafted text. On the other hand, CVE-2016-7415 is a stack-based buffer overflow vulnerability that enables an attacker with control of the locale string to perform a denial of service and potentially execute arbitrary code.
How To Fix
Minimum fixed version
4.8.1.1-12+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade icuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
The icu package is vulnerable to buffer overflow vulnerabilities (CVE-2014-9911 and CVE-2016-7415). To mitigate these vulnerabilities, it is crucial to upgrade the package to version 4.8.1.1-12+deb7u6 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for icu →
FAQ
The impact of these vulnerabilities can range from denial of service to potential execution of arbitrary code, depending on the attacker's capabilities.
There are no known exploits for these vulnerabilities at the time of this advisory.
Yes, these vulnerabilities can be exploited remotely by attackers.
No, there is no CVSS score available for these vulnerabilities at the time of this advisory.
In most cases, it is not necessary to restart the system after applying the fix. However, it is recommended to consult the documentation or contact your system administrator for specific instructions.
Related vulnerabilities
Recent vulnerabilities recorded for icu.
