CVE-2017-15422

Integer overflow in international date handling in International Components for Unicode ICU for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

Microsoft Edge Chakra InitializeNumberFormat / InitializeDateTimeFormat Type Confusion

Microsoft Edge: Chakra: Bugs in InitializeNumberFormat and InitializeDateTimeFormat CVE-2018-8298 The InitializeNumberFormat function in Intl.js is used to initialize an Intl.NumberFormat object, and InitializeDateTimeFormat is used for an Intl.DateTimeFormat object. There are two versions of eac...

Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion

Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion / The InitializeNumberFormat function in Intl.js is used to initialize an Intl.NumberFormat object, and InitializeDateTimeFormat is used for an Intl.DateTimeFormat object. There are two versions of each...

Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion Explo

Exploit for windows platform in category dos / poc / The InitializeNumberFormat function in Intl.js is used to initialize an Intl.NumberFormat object, and InitializeDateTimeFormat is used for an Intl.DateTimeFormat object. There are two versions of each initializer. One is for WinGlob and the oth...

Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion

/ The InitializeNumberFormat function in Intl.js is used to initialize an Intl.NumberFormat object, and InitializeDateTimeFormat is used for an Intl.DateTimeFormat object. There are two versions of each initializer. One is for WinGlob and the other is for ICU. The problem is that the versions for...

Security Bulletin: A vulnerability in icu affects IBM Flex System Manager (FSM) (CVE-2014-9654)

Summary A security vulnerability has been discovered in icu that is embedded in the IBM FSM. This bulletin addresses this vulnerability. Vulnerability Details CVEID: CVE-2014-9654 DESCRIPTION: ICU could allow a remote attacker to execute arbitrary code on the system, caused by improper size limit...

SUSE SLES11 Security Update : icu (SUSE-SU-2018:1602-1)

This update for icu fixes the following issues : - CVE-2016-6293: The ulocacceptLanguageFromHTTP function in common/uloc.cpp did not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service out-of-bounds read or...

SUSE-SU-2018:1602-1 Security update for icu

This update for icu fixes the following issues: - CVE-2016-6293: The ulocacceptLanguageFromHTTP function in common/uloc.cpp did not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service out-of-bounds read or...

icu/number_format_fuzzer: NULL

Detailed report: https://oss-fuzz.com/testcase?key=5066746749779968 Project: icu Fuzzer: libFuzzericunumberformatfuzzer Fuzz target binary: numberformatfuzzer Job Type: libfuzzermsanicu Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0077656e2f10 Crash State: NULL Sanitizer: memory...

openSUSE: Security Advisory for icu (openSUSE-SU-2018:1422-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for icu (moderate)

icu was updated to fix two security issues. These security issues were fixed: - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

openSUSE Security Update : icu (openSUSE-2018-517)

icu was updated to fix two security issues. These security issues were fixed : - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

SUSE SLED12 / SLES12 Security Update : icu (SUSE-SU-2018:1401-1)

icu was updated to fix two security issues. These security issues were fixed : - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

SUSE-SU-2018:1401-1 Security update for icu

icu was updated to fix two security issues. These security issues were fixed: - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

php: Stack-based buffer over-read in msgfmt_parse_message function

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformatparse.c does not restrict the locale length, which allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact within International...

icu/number_format_fuzzer: Crash in __msan_memset

Project: https://github.com/unicode-org/icu.git Detailed report: https://oss-fuzz.com/testcase?key=6252124296970240 Project: icu Fuzzer: libFuzzericunumberformatfuzzer Fuzz target binary: numberformatfuzzer Job Type: libfuzzermsanicu Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

icu/number_format_fuzzer: Heap-buffer-overflow in icu_61::number::impl::DecimalQuantity::ensureCapacity

Project: https://github.com/unicode-org/icu.git Detailed report: https://oss-fuzz.com/testcase?key=4583921284022272 Project: icu Fuzzer: libFuzzericunumberformatfuzzer Fuzz target binary: numberformatfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Cra...

Ubuntu: Security Advisory (USN-3610-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : ICU vulnerability (USN-3610-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3610-1 advisory. It was discovered that ICU incorrectly handled certain calendars. If an application using ICU processed crafted data, a remote attacker could possibly...

USN-3610-1: ICU vulnerability

It was discovered that ICU incorrectly handled certain calendars. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash, leading to a denial of service...