CVE-2017-7867
published 2017-04-14CVE-2017-7867: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the…
PriorityP342high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
4.63%
90.6th percentile
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | icu | < icu 57.1-6 (bookworm) | icu 57.1-6 (bookworm) |
| icu-project | international_components_for_unicode | <= 58.2 | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4p33-mgp9-vqp5: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to th
ghsa_unreviewed·2022-05-14
CVE-2017-7867 [HIGH] CWE-787 GHSA-4p33-mgp9-vqp5: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to th
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
OSV
CVE-2017-7867: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to th
osv·2017-04-14·CVSS 7.5
CVE-2017-7867 [HIGH] CVE-2017-7867: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to th
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
Ubuntu
ICU vulnerabilities
vendor_ubuntu·2017-07-18
CVE-2017-7867 ICU vulnerabilities
Title: ICU vulnerabilities
Summary: Several security issues were fixed in ICU.
USN-3274-1 fixed a vulnerability in icu. This update provides the
corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
ICU vulnerabilities
vendor_ubuntu·2017-05-02
CVE-2017-7867 ICU vulnerabilities
Title: ICU vulnerabilities
Summary: Several security issues were fixed in ICU.
It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
icu: Heap-buffer overflow in utext_setNativeIndex function
vendor_redhat·2017-02-13·CVSS 7.5
CVE-2017-7867 [HIGH] CWE-122 icu: Heap-buffer overflow in utext_setNativeIndex function
icu: Heap-buffer overflow in utext_setNativeIndex function
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
A vulnerability was found in the International Components for Unicode (ICU). Specially crafted invalid utf-8 text, when parsed or manipulated using particular functions in libicu, could cause out-of-bounds heap reads and writes potentially leading to a crash, memory disclosure, or possibly code execution.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, ref
Red Hat
icu: Heap-buffer overflow in utext_moveIndex32 function
vendor_redhat·2017-02-13·CVSS 7.5
CVE-2017-7868 [HIGH] CWE-122 icu: Heap-buffer overflow in utext_moveIndex32 function
icu: Heap-buffer overflow in utext_moveIndex32 function
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
Statement: This flaw was found to be a duplicate of CVE-2017-7867. Please see https://access.redhat.com/security/cve/CVE-2017-7867 for information about affected products and security errata.
Package: icu (Red Hat Directory Server 8) - Not affected
Package: icu (Red Hat Enterprise Linux 5) - Not affected
Package: icu (Red Hat Enterprise Linux 6) - Not affected
Package: icu (Red Hat Enterprise Linux 7) - Not affected
Package: icu (Red Hat OpenShift Enterprise 2) - Not affected
Debian
CVE-2017-7867: icu - International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an ou...
vendor_debian·2017·CVSS 7.5
CVE-2017-7867 [HIGH] CVE-2017-7867: icu - International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an ou...
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
Scope: local
bookworm: resolved (fixed in 57.1-6)
bullseye: resolved (fixed in 57.1-6)
forky: resolved (fixed in 57.1-6)
sid: resolved (fixed in 57.1-6)
trixie: resolved (fixed in 57.1-6)
No detection rules found.
No public exploits indexed.
Bugzilla
Backport CVE-2017-15422 to ESR52
bugzilla·2018-03-29·CVSS 6.5
CVE-2017-15422 [MEDIUM] Backport CVE-2017-15422 to ESR52
Backport CVE-2017-15422 to ESR52
Today, I noticed that Ubuntu updated its copy of ICU 57 to include the fix for CVE-2017-15422. From what I can tell, this was an integer overflow bug which was fixed late last year:
https://ssl.icu-project.org/trac/changeset/40654
Fx59+ are already fixed via the ICU 60.1 update. However, ESR52 is using ICU 58.2 still and is vulnerable from what I can tell.
Discussion:
Might not be a bad idea to look for any other ICU security backports that might have landed since 58.2 was shipped too.
---
(In reply to Ryan VanderMeulen [:RyanVM] from comment #0)
> However, ESR52 is using ICU 58.2 still and is vulnerable from what I can tell.
Do we know any details about the severity of the vulnerability? For example can it be used for remote code execution etc. ?
Bugzilla
CVE-2017-7867 CVE-2017-7868 mingw-icu: various flaws [fedora-all]
bugzilla·2017-04-20·CVSS 7.5
CVE-2017-7867 [HIGH] CVE-2017-7867 CVE-2017-7868 mingw-icu: various flaws [fedora-all]
CVE-2017-7867 CVE-2017-7868 mingw-icu: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Bugzilla
CVE-2017-7867 CVE-2017-7868 mingw-icu: various flaws [epel-7]
bugzilla·2017-04-20·CVSS 7.5
CVE-2017-7867 [HIGH] CVE-2017-7867 CVE-2017-7868 mingw-icu: various flaws [epel-7]
CVE-2017-7867 CVE-2017-7868 mingw-icu: various flaws [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the 'fedpkg update' reque
Bugzilla
CVE-2017-7867 icu: Heap-buffer overflow in utext_setNativeIndex function
bugzilla·2017-04-20·CVSS 7.5
CVE-2017-7867 [HIGH] CVE-2017-7867 icu: Heap-buffer overflow in utext_setNativeIndex function
CVE-2017-7867 icu: Heap-buffer overflow in utext_setNativeIndex function
International Components for Unicode (ICU) for C/C++ has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
References:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=213
Upstream patch:
http://bugs.icu-project.org/trac/changeset/39671
Discussion:
Created icu tracking bugs for this issue:
Affects: fedora-all [bug 1444101]
Created mingw-icu tracking bugs for this issue:
Affects: epel-7 [bug 1444100]
Affects: fedora-all [bug 1444099]
---
*** Bug 1444098 has been marked as a duplicate of this bug. ***
---
The OOB writes demonstrated by the oss-fuzz crasher are small writes in a libicu intern
Bugzilla
CVE-2017-7868 icu: Heap-buffer overflow in utext_moveIndex32 function
bugzilla·2017-04-20·CVSS 7.5
CVE-2017-7868 [HIGH] CVE-2017-7868 icu: Heap-buffer overflow in utext_moveIndex32 function
CVE-2017-7868 icu: Heap-buffer overflow in utext_moveIndex32 function
International Components for Unicode (ICU) for C/C++ has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
References:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437
Upstream patch:
http://bugs.icu-project.org/trac/changeset/39671
Discussion:
Created icu tracking bugs for this issue:
Affects: fedora-all [bug 1444101]
Created mingw-icu tracking bugs for this issue:
Affects: epel-7 [bug 1444100]
Affects: fedora-all [bug 1444099]
---
This is the same vulnerability as CVE-2017-7867 (bug 1444097), though clusterfuzz identified it as different due to a slightly different stack trace when the crash
Bugzilla
CVE-2017-7867 CVE-2017-7868 icu: various flaws [fedora-all]
bugzilla·2017-04-20·CVSS 7.5
CVE-2017-7867 [HIGH] CVE-2017-7867 CVE-2017-7868 icu: various flaws [fedora-all]
CVE-2017-7867 CVE-2017-7868 icu: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While
http://bugs.icu-project.org/trac/changeset/39671http://www.debian.org/security/2017/dsa-3830http://www.securityfocus.com/bid/97672https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=213https://security.gentoo.org/glsa/201710-03https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttp://bugs.icu-project.org/trac/changeset/39671http://www.debian.org/security/2017/dsa-3830http://www.securityfocus.com/bid/97672https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=213https://security.gentoo.org/glsa/201710-03https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
2017-04-14
Published