CVE-2020-10531

תיאור (מקור, אנגלית)

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

מדדים

CVSS 3.1

8.8 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-190, CWE-787

מוצרים מושפעים

icu-project: international components for unicode; redhat: enterprise linux desktop; redhat: enterprise linux server; redhat: enterprise linux workstation; google: chrome; fedoraproject: fedora; debian: debian linux; canonical: ubuntu linux; opensuse: leap; oracle: banking extensibility workbench; nodejs: node.js

קישורים

• https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018‮… PatchThird Party Advisory
• https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7‮… PatchThird Party Advisory
• https://github.com/unicode-org/icu/pull/971 Issue TrackingPatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
• https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018‮… PatchThird Party Advisory
• https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7‮… PatchThird Party Advisory
• https://github.com/unicode-org/icu/pull/971 Issue TrackingPatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html Mailing ListThird Party Advisory
• https://access.redhat.com/errata/RHSA-2020:0738 Third Party Advisory