PT-2019-6190 · Icu+3 · International Components For Unicode+3

Rongxin Wu · Published 2019-10-03 · Updated 2025-06-24 · CVE-2020-21913

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) version 66.1

Description The issue is related to a use after free bug in the pkg createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. This bug can be exploited by a remote attacker to cause a denial of service.

Recommendations For International Components for Unicode (ICU) version 66.1, update to a version that fixes the use after free bug in the pkg createWithAssemblyCode function. As a temporary workaround, consider restricting access to the pkg createWithAssemblyCode function to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-01754

CVE-2020-21913

DLA-2784-1

DSA-5014-1

OESA-2021-1406

OPENSUSE-SU-2022_3141-1

OPENSUSE-SU-2023_3563-1

OPENSUSE-SU-2024:13127-1

SUSE-SU-2022:3140-1

SUSE-SU-2022:3141-1

SUSE-SU-2022:3142-1

SUSE-SU-2022_3140-1

SUSE-SU-2022_3141-1

SUSE-SU-2022_3142-1

SUSE-SU-2023:3563-1

SUSE-SU-2023:3563-2

SUSE-SU-2023:3563-3

SUSE-SU-2025:02079-1

SUSE-SU-2025_02079-1

USN-5133-1

Affected Products

Astra Linux

International Components For Unicode

Suse

Ubuntu

References · 67

• 🔥 https://unicode-org.atlassian.net/browse/ICU-20850 · Exploit
• https://github.com/unicode-org/icu/pull/886 · Patch
• https://osv.dev/vulnerability/CVE-2020-21913 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2784-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-21913 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1406 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3140-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21913 · Security Note
• https://ubuntu.com/security/CVE-2020-21913 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-21913 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3141-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01754 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://debian.org/security/2021/dsa-5014 · Vendor Advisory