CVE-2007-4770 libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers....
MediumCVSS 6.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| icu-project international components for unicode | <= 3.8.1 | No fix listed |
| debian/icu(Debian:12) | < 3.8-6 | 3.8-6 |
| debian/icu(Debian:13) | < 3.8-6 | 3.8-6 |
| debian/icu(Debian:14) | < 3.8-6 | 3.8-6 |
References
- SUSE-SR:2008:005 third-party-advisory vendor-advisory
- RHSA-2008:0090 third-party-advisory vendor-advisory
- 28575 permissions-required third-party-advisory
- 28615 permissions-required third-party-advisory
- 28669 permissions-required third-party-advisory
- 28783 permissions-required third-party-advisory
- 29194 permissions-required third-party-advisory
- 29242 permissions-required third-party-advisory
- 29291 permissions-required third-party-advisory
- 29294 permissions-required third-party-advisory
- 29333 permissions-required third-party-advisory
- 29852 permissions-required third-party-advisory
- 29910 permissions-required third-party-advisory
- 29987 permissions-required third-party-advisory
- 30179 permissions-required third-party-advisory
- GLSA-200803-20 third-party-advisory vendor-advisory
- GLSA-200805-16 third-party-advisory vendor-advisory
- 1019269 third-party-advisory vdb-entry
- [icu-support] 20080122 ICU Patch for bugs in Regular Expressions broken-link mailing-list patch third-party-advisory
- 231641 broken-link vendor-advisory
- 233922 broken-link vendor-advisory
- wiki.rpath.com third-party-advisory
- DSA-1511 third-party-advisory vendor-advisory
- MDVSA-2008:026 broken-link vendor-advisory
- SUSE-SA:2008:023 third-party-advisory vendor-advisory
- www.openoffice.org third-party-advisory
- www.openoffice.org third-party-advisory
- 20080206 rPSA-2008-0043-1 icu mailing-list
- 27455 third-party-advisory vdb-entry
- USN-591-1 third-party-advisory vendor-advisory
- ADV-2008-0282 third-party-advisory vdb-entry
- ADV-2008-0807 third-party-advisory vdb-entry
- ADV-2008-1375 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- libicu-restackframes-dos(39938) third-party-advisory vdb-entry
- issues.rpath.com third-party-advisory
- oval:org.mitre.oval:def:11172 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:5507 signature third-party-advisory vdb-entry
- FEDORA-2008-1036 third-party-advisory vendor-advisory
- FEDORA-2008-1076 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2007-4770 vendor-advisory
- bugs.debian.org issue-tracking