CVE-2011-4599high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
References
http://bugs.icu-project.org/trac/ticket/8984
http://code.google.com/p/chromium/issues/detail?id=106441
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html
http://rhn.redhat.com/errata/RHSA-2011-1815.html
http://secunia.com/advisories/47146
http://secunia.com/advisories/47227
http://secunia.com/advisories/47674
http://secunia.com/advisories/47714
http://secunia.com/advisories/47775
http://support.apple.com/kb/HT5501
http://support.apple.com/kb/HT5503
http://ubuntu.com/usn/usn-1348-1
http://www.debian.org/security/2012/dsa-2397
http://www.mandriva.com/security/advisories?name=MDVSA-2011:194
http://www.openwall.com/lists/oss-security/2011/12/09/2
http://www.openwall.com/lists/oss-security/2011/12/09/5
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:icu-project:international_components_for_unicode:*:*:*:*:*:c\/c\+\+:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 80641 | Oracle Solaris Third-Party Patch Update : icu (multiple_vulnerabilities_in_international_components) | Nessus | Solaris Local Security Checks | high |
| 75866 | openSUSE Security Update : icu (openSUSE-SU-2012:0100-1) | Nessus | SuSE Local Security Checks | high |
| 75530 | openSUSE Security Update : icu (openSUSE-SU-2012:0100-1) | Nessus | SuSE Local Security Checks | high |
| 69640 | Amazon Linux AMI : icu (ALAS-2012-33) | Nessus | Amazon Linux Local Security Checks | high |
| 68406 | Oracle Linux 5 / 6 : icu (ELSA-2011-1815) | Nessus | Oracle Linux Local Security Checks | high |
| 64157 | SuSE 11.2 Security Update : icu (SAT Patch Number 7204) | Nessus | SuSE Local Security Checks | high |
| 62357 | Apple TV < 5.1 Multiple Vulnerabilities | Nessus | Gain a shell remotely | high |
| 62288 | GLSA-201209-07 : International Components for Unicode: User-assisted execution of arbitrary code | Nessus | Gentoo Local Security Checks | high |
| 6589 | Apple iOS < 6.0 Multiple Vulnerabilities | Nessus Network Monitor | Mobile Devices | high |
| 62242 | Apple iOS < 6.0 Multiple Vulnerabilities | Nessus | Mobile Devices | critical |
| 6583 | Mac OS X 10.7 < 10.7.5 Multiple Vulnerabilities | Nessus Network Monitor | Generic | critical |
| 62214 | Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST) | Nessus | MacOS X Local Security Checks | critical |
| 62213 | Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST) | Nessus | MacOS X Local Security Checks | critical |
| 61205 | Scientific Linux Security Update : icu on SL5.x, SL6.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | high |
| 58577 | SuSE 10 Security Update : LibreOffice (ZYPP Patch Number 8022) | Nessus | SuSE Local Security Checks | high |
| 57737 | Debian DSA-2397-1 : icu - buffer underflow | Nessus | Debian Local Security Checks | high |
| 57706 | Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : icu vulnerability (USN-1348-1) | Nessus | Ubuntu Local Security Checks | high |
| 57613 | SuSE 11.1 Security Update : icu (SAT Patch Number 5653) | Nessus | SuSE Local Security Checks | high |
| 57407 | Mandriva Linux Security Advisory : icu (MDVSA-2011:194) | Nessus | Mandriva Local Security Checks | high |
| 57388 | Fedora 15 : icu-4.4.2-9.fc15 (2011-17119) | Nessus | Fedora Local Security Checks | high |
| 57386 | Fedora 16 : icu-4.6-3.fc16 (2011-17101) | Nessus | Fedora Local Security Checks | high |
| 57296 | RHEL 5 / 6 : icu (RHSA-2011:1815) | Nessus | Red Hat Local Security Checks | high |
| 57291 | CentOS 5 / 6 : icu (CESA-2011:1815) | Nessus | CentOS Local Security Checks | high |