CVE-2020-10531

2020-03-1200:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

73.8%

JSON

An issue was discovered in International Components for Unicode (ICU) for
C/C++ through 66.1. An integer overflow, leading to a heap-based buffer
overflow, exists in the UnicodeString::doAppend() function in
common/unistr.cpp.

Bugs

Notes

Author	Note
leosilva	According with debian versions bellow 52.1.8 are not affected because code is not present, though, it needs further confirmation. keep precise/trusty as needs-triage.
mdeslaur	in xenial and older releases, vulnerable code looks to be in UnicodeString::doReplace, need to investigate
leosilva	doAppend was write based on doReplace, that originally shipped the vul code more info, check commit 3d77fc18b8b. Marking precise/trusty as needed.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchchromium-browser< 80.0.3987.149-0ubuntu0.18.04.1UNKNOWN
ubuntu16.04noarchchromium-browser< 80.0.3987.149-0ubuntu0.16.04.1UNKNOWN
ubuntu18.04noarchicu< 60.2-3ubuntu3.1UNKNOWN
ubuntu19.10noarchicu< 63.2-2ubuntu0.1UNKNOWN
ubuntu14.04noarchicu< 52.1-3ubuntu0.8+esm1UNKNOWN
ubuntu16.04noarchicu< 55.1-7ubuntu0.5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	chromium-browser	< 80.0.3987.149-0ubuntu0.18.04.1	UNKNOWN
ubuntu	16.04	noarch	chromium-browser	< 80.0.3987.149-0ubuntu0.16.04.1	UNKNOWN
ubuntu	18.04	noarch	icu	< 60.2-3ubuntu3.1	UNKNOWN
ubuntu	19.10	noarch	icu	< 63.2-2ubuntu0.1	UNKNOWN
ubuntu	14.04	noarch	icu	< 52.1-3ubuntu0.8+esm1	UNKNOWN
ubuntu	16.04	noarch	icu	< 55.1-7ubuntu0.5	UNKNOWN