CVE-2014-9911 Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a deni...
CriticalCVSS 9.8
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icu(Debian:12) | < 55.1-3 | 55.1-3 |
| debian/icu(Debian:13) | < 55.1-3 | 55.1-3 |
| debian/icu(Debian:14) | < 55.1-3 | 55.1-3 |
| icu-project international components for unicode | < 54.1 | 54.1 |
References
- Debian Security Tracker CVE-2014-9911 vendor-advisory
- bugs.icu-project.org patch vendor-advisory
- bugs.icu-project.org not-applicable
- [oss-security] 20161124 Re: CVE request: icu: stack-based buffer overflow in uloc_getDisplayName mailing-list third-party-advisory
- 94520 third-party-advisory vdb-entry
- 1037556 third-party-advisory vdb-entry
- bugs.php.net patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory vdb-entry
- www.oracle.com