Every CVE Search/ Get API key

CVE-2007-4770

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process...

6.8 MediumFix available

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Exploit likelihood

2.93%Up 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Record
CVE-2007-4770
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Record
CVE-2007-4770
Updated
2026-11-02
EUVDEUVD-2007-4751 No score

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Record
EUVD-2007-4751
Updated
2026-11-03
GitHub AdvisoriesGHSA-3hvj-9j8h-vgr2 No score

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process...

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Record
GHSA-3hvj-9j8h-vgr2
Updated
2026-11-02
OSV No score

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Record
CVE-2007-4770
Updated
2026-11-02
OSVDEBIAN-CVE-2007-4770 No score

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Record
DEBIAN-CVE-2007-4770
Updated
2026-11-02
OSVopenSUSE-SU-2024:10859-1 No score

icu-69.1-2.3 on GA media

These are all security issues fixed in the icu-69.1-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10859-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icu
Debian:12
 before 3.8-6
3.8-6
icu
Debian:13
 before 3.8-6
3.8-6
icu
Debian:14
 before 3.8-6
3.8-6
icu
Debian:4.0
From an advisory covering 2 CVEs
 before 3.6-2etch1, plus listed versions
3.6-2
3.6-2etch1
icu
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
icu-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
libicu-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
icu
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
icu-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
libicu
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
libicu-doc
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
icu
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
icu-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
libicu
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
libicu-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
libicu-doc
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.6-5.11.1
0:3.6-5.11.1
icu
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 69.1-2.3
69.1-2.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
aliases
affected, aliases, facts, references, titleGitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-4770 is a medium vulnerability (CVSS 6.8) in Icu-project International Components For Unicode, published January 28, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.93%, the 87th percentile. Fixed in icu 3.8-6.

References

Show 48 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open