CVE-2011-4599 — Improper Restriction of Operations within the Bounds of a Memory Buffer in International Components FOR Unicode

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-121 — Stack-based Buffer Overflow9 documents8 sources
Severity
7.5HIGHNVD
EPSS
35.8%
top 2.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Icu-project International Components FOR Unicode
Timeline
PublishedJun 21
Latest updateMay 14

Description

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-95hv-27rj-qc2p: Stack-based buffer overflow in the _canonicalize function in common/uloc↗2022-05-14
▶
CVEList
CVE-2011-4599: Stack-based buffer overflow in the _canonicalize function in common/uloc↗2012-06-21
▶
OSV
CVE-2011-4599: Stack-based buffer overflow in the _canonicalize function in common/uloc↗2012-06-21
▶

📋Vendor Advisories

3
Ubuntu
ICU vulnerability↗2012-01-26
▶
Red Hat
icu: Stack-based buffer overflow by canonicalizing the given localeID↗2011-12-07
▶
Debian
CVE-2011-4599: icu - Stack-based buffer overflow in the _canonicalize function in common/uloc.c in In...↗2011
▶

💬Community

2
Bugzilla
CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given localeID [fedora-all]↗2011-12-12
▶
Bugzilla
CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given localeID↗2011-12-09
▶
CVE-2011-4599 — HIGH severity | cvebase