CVE-2011-4599

HIGH

Description

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

References

http://bugs.icu-project.org/trac/ticket/8984

http://code.google.com/p/chromium/issues/detail?id=106441

http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html

http://rhn.redhat.com/errata/RHSA-2011-1815.html

http://secunia.com/advisories/47146

http://secunia.com/advisories/47227

http://secunia.com/advisories/47674

http://secunia.com/advisories/47714

http://secunia.com/advisories/47775

http://support.apple.com/kb/HT5501

http://support.apple.com/kb/HT5503

http://ubuntu.com/usn/usn-1348-1

http://www.debian.org/security/2012/dsa-2397

http://www.mandriva.com/security/advisories?name=MDVSA-2011:194

http://www.openwall.com/lists/oss-security/2011/12/09/2

http://www.openwall.com/lists/oss-security/2011/12/09/5

http://www.osvdb.org/77698

http://www.securityfocus.com/bid/51006

https://exchange.xforce.ibmcloud.com/vulnerabilities/71726

Details

Source: MITRE

Published: 2012-06-21

Updated: 2018-01-24

Type: CWE-119

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (23 total)

ID	Name	Product	Family	Severity
80641	Oracle Solaris Third-Party Patch Update : icu (multiple_vulnerabilities_in_international_components)	Nessus	Solaris Local Security Checks	high
75866	openSUSE Security Update : icu (openSUSE-SU-2012:0100-1)	Nessus	SuSE Local Security Checks	high
75530	openSUSE Security Update : icu (openSUSE-SU-2012:0100-1)	Nessus	SuSE Local Security Checks	high
69640	Amazon Linux AMI : icu (ALAS-2012-33)	Nessus	Amazon Linux Local Security Checks	high
68406	Oracle Linux 5 / 6 : icu (ELSA-2011-1815)	Nessus	Oracle Linux Local Security Checks	high
64157	SuSE 11.2 Security Update : icu (SAT Patch Number 7204)	Nessus	SuSE Local Security Checks	high
62357	Apple TV < 5.1 Multiple Vulnerabilities	Nessus	Gain a shell remotely	high
62288	GLSA-201209-07 : International Components for Unicode: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
62242	Apple iOS < 6.0 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
6589	Apple iOS < 6.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
6583	Mac OS X 10.7 < 10.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	critical
62213	Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)	Nessus	MacOS X Local Security Checks	critical
61205	Scientific Linux Security Update : icu on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
58577	SuSE 10 Security Update : LibreOffice (ZYPP Patch Number 8022)	Nessus	SuSE Local Security Checks	high
57737	Debian DSA-2397-1 : icu - buffer underflow	Nessus	Debian Local Security Checks	high
57706	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : icu vulnerability (USN-1348-1)	Nessus	Ubuntu Local Security Checks	high
57613	SuSE 11.1 Security Update : icu (SAT Patch Number 5653)	Nessus	SuSE Local Security Checks	high
57407	Mandriva Linux Security Advisory : icu (MDVSA-2011:194)	Nessus	Mandriva Local Security Checks	high
57388	Fedora 15 : icu-4.4.2-9.fc15 (2011-17119)	Nessus	Fedora Local Security Checks	high
57386	Fedora 16 : icu-4.6-3.fc16 (2011-17101)	Nessus	Fedora Local Security Checks	high
57296	RHEL 5 / 6 : icu (RHSA-2011:1815)	Nessus	Red Hat Local Security Checks	high
57291	CentOS 5 / 6 : icu (CESA-2011:1815)	Nessus	CentOS Local Security Checks	high