Heap-based buffer overflow in icu - CVE-2014-8146

Vulnerability details

The vulnerability allows a remote attacker to cause Dos condition or execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow when the resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C does not properly track directionally isolated pieces of text. A remote unauthenticated attacker can supply specially crafted text file, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2014-8146

Links to Public Exploits and PoC-codes

• Exploit #6395 - ICU library 52 < 54 - Multiple Vulnerabilities (June 17, 2021)

External References

• http://seclists.org/fulldisclosure/2015/May/14

Related Security Bulletins

• OpenSUSE Linux update for icu
• Ubuntu update for ICU
• Gentoo update for International Components for Unicode
• Heap-based buffer overflow in icu (Alpine package)
• Multiple vulnerabilities in IBM DataPower Gateway Virtual Edition
• Multiple vulnerabilities in IBM Storage Defender - Data Protect
• Multiple vulnerabilities in IBM Rational ClearQuest