Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-7868: ICU library may cause program crashes

CVE-2017-7868 · published 9 years ago

Summary

The International Components for Unicode (ICU) library for C/C++ released before February 2017 can write data past the end of its memory buffer. This memory overrun can cause applications that use the library to crash or behave unpredictably. Upgrade to the latest ICU version to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
icu-project	international_components_for_unicode	<= 58.2 `cpe:2.3:a:icu-project:international_components_for_unicode::::::c\/c\+\+::*`
debian	debian_linux	8.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp a...

References

http://bugs.icu-project.org/trac/changeset/39671 Patch
http://www.debian.org/security/2017/dsa-3830 Third Party Advisory
http://www.securityfocus.com/bid/97674 Third Party Advisory VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437 Third Party Advisory
https://security.gentoo.org/glsa/201710-03 Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

4% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published14 Apr 2017

Updated24 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-7868 · NVD

Track software like this

Free during beta