Double free memory error in icu - CVE-2017-14952
Published: May 30, 2018
Vulnerability identifier: #VU13054
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-14952
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to double free memory error in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++. A remote unauthenticated attacker can supply a ca specially crafted string, aka a "redundant UVector entry clean up function call" issue, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
icu
Arch Linux
IBM i
Ubuntu
Fedora
IBM DataPower Gateway
openSUSE Leap
icu
Arch Linux
IBM i
Ubuntu
Fedora
IBM DataPower Gateway
openSUSE Leap
icu
How to mitigate CVE-2017-14952
Update to version 59.1.
IBM DataPower Gateway - addressed in versions 10.0.1.5, 10.0.4.0, 2018.4.1.18
icu - addressed in versions 57.1-7.fc26, 57.1-9.fc27
icu - addressed in versions 57.1-7.fc26, 57.1-9.fc27