CVE-2011-4599
icu: Stack-based buffer overflow by canonicalizing the given localeID
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
Un desbordamiento de búfer basado en pila en la función _canonicalize en common/uloc.c en International Componentes for Unicode (ICU) antes de v49.1 permite a atacantes remotos ejecutar código de su elección a través de un identificador de configuración regional modificado a mano que no es debidamente manejado durante la canonización de variantes.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2011-11-29 CVE Reserved
- 2011-12-14 CVE Published
- 2024-08-07 CVE Updated
- 2024-09-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-121: Stack-based Buffer Overflow
CAPEC
References (18)
URL | Tag | Source |
---|---|---|
http://code.google.com/p/chromium/issues/detail?id=106441 | Third Party Advisory | |
http://support.apple.com/kb/HT5501 | Third Party Advisory | |
http://support.apple.com/kb/HT5503 | Third Party Advisory | |
http://www.openwall.com/lists/oss-security/2011/12/09/2 | Mailing List | |
http://www.openwall.com/lists/oss-security/2011/12/09/5 | Mailing List | |
http://www.osvdb.org/77698 | Broken Link | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/71726 | Vdb Entry |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://www.securityfocus.com/bid/51006 | 2023-02-13 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Icu-project Search vendor "Icu-project" | International Components For Unicode Search vendor "Icu-project" for product "International Components For Unicode" | < 49.1 Search vendor "Icu-project" for product "International Components For Unicode" and version " < 49.1" | c\/c\+\+ |
Affected
|