Vulnerability Details CVE-2017-17484
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 75.1%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://github.com/znc/znc/issues/1459
- https://ssl.icu-project.org/trac/attachment/ticket/13490/poc.cpp
- https://ssl.icu-project.org/trac/changeset/40714
- https://ssl.icu-project.org/trac/changeset/40715
- https://ssl.icu-project.org/trac/ticket/13490
- https://ssl.icu-project.org/trac/ticket/13510
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://github.com/znc/znc/issues/1459
- https://ssl.icu-project.org/trac/attachment/ticket/13490/poc.cpp
- https://ssl.icu-project.org/trac/changeset/40714
- https://ssl.icu-project.org/trac/changeset/40715
- https://ssl.icu-project.org/trac/ticket/13490
- https://ssl.icu-project.org/trac/ticket/13510
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Products affected by CVE-2017-17484
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.4
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.4.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.4.1.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.4.1.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.4.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.5
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.6
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.7
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.8
-
cpe:2.3:a:icu-project:international_components_for_unicode:1.8.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.0
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.0.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.0.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.4
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.6
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.6.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.6.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:2.8
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.0
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.2.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.4
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.4.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.6
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.8
-
cpe:2.3:a:icu-project:international_components_for_unicode:3.8.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.0
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.0.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.2.0.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.4.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.4.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.4.2.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.6
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.6.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.8
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.8.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:4.8.1.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:49.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:49.1.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:49.1.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:50.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:50.1.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:50.1.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:50.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:51.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:51.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:51.3
-
cpe:2.3:a:icu-project:international_components_for_unicode:52.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:52.1.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:52.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:53.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:53.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:54.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:54.1.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:54.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:55.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:55.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:56.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:56.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:57.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:57.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:58.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:58.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:58.3
-
cpe:2.3:a:icu-project:international_components_for_unicode:59
-
cpe:2.3:a:icu-project:international_components_for_unicode:59.1
-
cpe:2.3:a:icu-project:international_components_for_unicode:59.2
-
cpe:2.3:a:icu-project:international_components_for_unicode:60
-
cpe:2.3:a:icu-project:international_components_for_unicode:60.1