PT-2008-1111 · Icu+1 · International Components For Unicode+1

Published 2008-01-25 · Updated 2024-06-15 · CVE-2007-4770

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) versions 3.8.1 and earlier

Description The issue is related to a mechanism error in the International Components for Unicode (ICU) library, which might allow attackers to read from or write to out-of-bounds memory locations. This could potentially lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The problem is associated with the library's attempt to process backreferences to a nonexistent capture group, specifically 0, which can cause memory corruption.

Recommendations For International Components for Unicode (ICU) versions 3.8.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09603

CVE-2007-4770

DSA-1511-1

OPENSUSE-SU-2024:10859-1

RHSA-2008:0090

RHSA-2008_0090

Affected Products

International Components For Unicode

Red Hat

References · 53

• https://security-tracker.debian.org/tracker/CVE-2007-4771 · Vendor Advisory
• http://ubuntu.com/usn/usn-591-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-January/msg00921.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2008_23_openoffice.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4771 · Security Note
• https://osv.dev/vulnerability/CVE-2007-4770 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4770 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-16.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-231641-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-233922-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4770 · Security Note
• http://security.gentoo.org/glsa/glsa-200803-20.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:026 · Vendor Advisory