CVE-2014-8147 The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type....
HighCVSS 7.5
EPSS 23.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icu(Debian:12) | < 52.1-9 | 52.1-9 |
| debian/icu(Debian:13) | < 52.1-9 | 52.1-9 |
| debian/icu(Debian:14) | < 52.1-9 | 52.1-9 |
| apple mac os x | <= 10.10.4 | No fix listed |
| apple watchOS | <= 1.0.1 | No fix listed |
| icu-project international components for unicode | < 55.1 | 55.1 |
References
- Debian Security Tracker CVE-2014-8147 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.icu-project.org issue-tracking vendor-advisory
- APPLE-SA-2015-09-21-1 mailing-list vendor-advisory
- APPLE-SA-2015-09-30-3 mailing-list vendor-advisory
- [oss-security] 20150505 [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL mailing-list
- 20150505 [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL exploit mailing-list third-party-advisory
- DSA-3323 third-party-advisory vendor-advisory
- VU#602540 third-party-advisory us-government-resource
- www.oracle.com third-party-advisory
- www.oracle.com patch
- 74457 third-party-advisory vdb-entry
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- raw.githubusercontent.com exploit
- GLSA-201507-04 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- www.oracle.com