PT-2008-1111 · Icu+1 · International Components For Unicode+1

Publicado 2008-01-25 · Atualizado 2024-06-15 · CVE-2007-4770

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) versions 3.8.1 and earlier

Description The issue is related to a mechanism error in the International Components for Unicode (ICU) library, which might allow attackers to read from or write to out-of-bounds memory locations. This could potentially lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The problem is associated with the library's attempt to process backreferences to a nonexistent capture group, specifically 0, which can cause memory corruption.

Recommendations For International Components for Unicode (ICU) versions 3.8.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-09603

CVE-2007-4770

DSA-1511-1

OPENSUSE-SU-2024:10859-1

RHSA-2008:0090

RHSA-2008_0090

Produtos afetados

International Components For Unicode

Red Hat

Referências · 53

• https://access.redhat.com/security/cve/CVE-2007-4770 · Nota
• http://securityfocus.com/bid/27455 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-4771 · Aviso do Fabricante
• http://secunia.com/advisories/29194 · Nota
• http://secunia.com/advisories/28615 · Nota
• http://ubuntu.com/usn/usn-591-1 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-January/msg00921.html · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2008_23_openoffice.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4771 · Nota de Segurança
• https://suse.com/security/cve/CVE-2008-1036 · Nota
• http://openoffice.org/security/cves/CVE-2007-5745.html · Nota
• http://secunia.com/advisories/30179 · Nota
• https://osv.dev/vulnerability/CVE-2007-4770 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4770 · Aviso do Fabricante
• http://openoffice.org/security/cves/CVE-2007-4770.html · Nota