Heap-based buffer overflow in icu - CVE-2017-7867
Published: July 18, 2017 / Updated: May 30, 2018
Vulnerability identifier: #VU7568
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7867
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error in utf8TextAccess() function in common/utext.cpp and the utext_moveIndex32* function in International Components for Unicode (ICU) for C/C++ before 2017-02-13. A remote unauthenticated attacker can trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
icu
Gentoo Linux
Ubuntu
Fedora
openSUSE Leap
icu (Alpine package)
icu
Flex System Chassis Management Module (CMM)
Gentoo Linux
Ubuntu
Fedora
openSUSE Leap
icu (Alpine package)
icu
Flex System Chassis Management Module (CMM)
How to mitigate CVE-2017-7867
Install update from vendor's website.
icu (Alpine package) - update to 55.1-r3
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
icu - addressed in versions 56.1-8.fc24, 57.1-5.fc25, 57.1-6.fc26
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
icu - addressed in versions 56.1-8.fc24, 57.1-5.fc25, 57.1-6.fc26