CVE-2018-18928 International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
CriticalCVSS 9.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icu(Debian:12) | < 63.1-3 | 63.1-3 |
| debian/icu(Debian:13) | < 63.1-3 | 63.1-3 |
| debian/icu(Debian:14) | < 63.1-3 | 63.1-3 |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| icu-project international components for unicode | = 63.1 | No fix listed |
References
- Debian Security Tracker CVE-2018-18928 vendor-advisory
- github.com patch vendor-advisory
- unicode-org.atlassian.net vendor-advisory
- bugs.chromium.org third-party-advisory
- cert-portal.siemens.com