PT-2018-14728 · International Components For Unicode · Icu

Published 2018-11-04 · Updated 2019-12-06 · CVE-2018-18928

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) for C/C++ version 63.1

Description The issue is related to an integer overflow in the toScientificString() function within the number::impl::DecimalQuantity class, located in the i18n/number decimalquantity.cpp file.

Recommendations For International Components for Unicode (ICU) for C/C++ version 63.1, consider updating to a newer version that addresses the integer overflow issue in the toScientificString() function. As a temporary workaround, restrict the use of the toScientificString() function until a patch is available.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2018-18928

MGASA-2019-0353

Affected Products

Icu

References · 11

• https://github.com/unicode-org/icu/commit/53d8c8f3d181d87a6aa925b449b51c4a2c922a51 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0353 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18928 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/DHAC6XIATCPVSWFNBGGL2MRSBMN2F7D5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18928 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0353.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-18928 · Vendor Advisory
• https://unicode-org.atlassian.net/browse/ICU-20246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18928 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=23155 · Note
• https://bugs.chromium.org/p/chromium/issues/detail?id=900059 · Note