Vulnerabilities > ICU Project

DATE CVE VULNERABILITY TITLE RISK
2020-03-12 CVE-2020-10531 Integer Overflow or Wraparound vulnerability in multiple products
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1.
8.8
2018-11-04 CVE-2018-18928 Integer Overflow or Wraparound vulnerability in Icu-Project International Components for Unicode 63.1
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
network
low complexity
icu-project CWE-190
critical
9.8
2018-08-28 CVE-2017-15396 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
network
low complexity
google redhat debian icu-project CWE-119
6.5
2018-08-28 CVE-2017-15422 Integer Overflow or Wraparound vulnerability in multiple products
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
network
low complexity
google icu-project debian canonical redhat CWE-190
6.5
2017-12-10 CVE-2017-17484 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Icu-Project International Components for Unicode
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.
network
low complexity
icu-project CWE-119
critical
9.8
2017-10-16 CVE-2017-14952 Double Free vulnerability in Icu-Project International Components for Unicode
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.
network
low complexity
icu-project CWE-415
critical
9.8
2017-04-24 CVE-2014-9654 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.
network
low complexity
google icu-project CWE-119
critical
9.8
2017-04-14 CVE-2017-7868 Out-of-bounds Write vulnerability in multiple products
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
network
low complexity
icu-project debian CWE-787
7.5
2017-04-14 CVE-2017-7867 Out-of-bounds Write vulnerability in multiple products
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
network
low complexity
icu-project debian CWE-787
7.5
2017-01-04 CVE-2014-9911 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Icu-Project International Components for Unicode
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.
network
low complexity
icu-project CWE-119
critical
9.8