CVE-2020-10531
HIGH severity · CVSS 8.8 · Integer overflow
8.8CVSS HIGH
Summary
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)3%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products we track (5)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08 ↗
Additional information
- NVD record
- https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08Patch
- https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afcaPatch
- https://github.com/unicode-org/icu/pull/971Patch
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.htmlAdvisory
- https://access.redhat.com/errata/RHSA-2020:0738Advisory
- https://bugs.chromium.org/p/chromium/issues/detail?id=1044570Advisory
- https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.htmlAdvisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00024.htmlAdvisory