ICU Project ICU4C library contains multiple overflow vulnerabilities

Overview

ICU Project ICU4C library, versions 52 through 54, contains a heap-based buffer overflow and an integer overflow.

Description

The ICU Project describes ICU as “a mature, widely used set of C/C++ and Java libraries providing Unicode and Globalization support for software applications.”

CWE-122: Heap-based Buffer Overflow- CVE-2014-8146

Multiple out-of-bounds writes may occur in the resolveImplicitLevels function of ubidi.c in affected versions of ICU4C.

CWE-190: Integer Overflow or Wraparound - CVE-2014-8147

An integer overflow may occur in the resolveImplicitLevels function of ubidi.c in affected versions of ICU4C due to the assignment of an int32 value to an int16 type.

Both issues may lead to denial of service and the possibility of code execution. For more details, refer to Pedro Ribeiro’s disclosure.

---

Impact

An attacker may be able to provide input that triggers one or both overflow vulnerabilities, leading to denial of service and the possibility of code execution.

---

Solution

Apply an update

These issues have been addressed in ICU4C version 55.1. Developers are encouraged to update applications that make use of affected versions of ICU4C. Users of affected products should check with product vendors for updates that utilize a patched version of ICU4C.

---

Vendor Information

602540

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Debian GNU/Linux Affected

Notified: April 30, 2015 Updated: August 03, 2015

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://www.debian.org/security/2015/dsa-3323&gt;

FreeBSD Project __ Affected

Notified: April 30, 2015 Updated: May 01, 2015

Statement Date: April 30, 2015

Status

Affected

Vendor Statement

`Thanks for the notification. We believe this have been already
addressed in FreeBSD about a week ago:

https://svnweb.freebsd.org/ports?view=revision&revision=384614

Prior to that we are affected as the previous icu version was 53.1.`

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• https://svnweb.freebsd.org/ports?view=revision&revision=384614

ICU Project __ Affected

Notified: April 24, 2015 Updated: May 04, 2015

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://site.icu-project.org/download&gt;

Addendum

ICU4C versions 52 through 54 are affected by these vulnerabilities.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23602540 Feedback>).

SAP Not Affected

Notified: April 30, 2015 Updated: May 07, 2015

Statement Date: May 06, 2015

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Adobe Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Amazon Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Apache HTTP Server Project Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Apple Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Avaya, Inc. Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

BAE Systems Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Business Objects Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Dell Computer Corporation, Inc. Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

EMC Corporation Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Eclipse Foundation Inc Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Environmental Systems Research Institute Inc Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Gentoo Linux Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Google Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Hewlett-Packard Company Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

IBM Corporation Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Intel Corporation Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Mandriva S. A. Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Mozilla Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OpenOffice.org Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Progress Software, Inc. Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

QNX Software Systems Inc. Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SUSE Linux Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sybase Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Symantec Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Trend Micro Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Yahoo, Inc. Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

eBay Unknown

Notified: April 30, 2015 Updated: April 30, 2015

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

View all 31 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P
Temporal	3.4	E:POC/RL:OF/RC:C
Environmental	3.4	CDP:N/TD:H/CR:ND/IR:ND/AR:ND

References

• <http://site.icu-project.org/&gt;
• <http://site.icu-project.org/download/55&gt;
• <http://site.icu-project.org/#TOC-Who-Uses-ICU-&gt;
• <https://cwe.mitre.org/data/definitions/122.html&gt;
• <https://cwe.mitre.org/data/definitions/190.html&gt;
• <https://raw.githubusercontent.com/pedrib/PoC/master/generic/i-c-u-fail.txt&gt;

Acknowledgements

Thanks to Pedro Ribeiro ([email protected]) of Agile Information Security for reporting this vulnerability.

This document was written by Joel Land.

Other Information

CVE IDs:	CVE-2014-8146, CVE-2014-8147
Date Public:	2015-05-04 Date First Published: