Every CVE Search/ Get API key

CVE-2008-1036

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat...

4.3 MediumFix available

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Exploit likelihood

3.19%Down 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Record
CVE-2008-1036
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Record
CVE-2008-1036
Updated
2026-11-02
EUVDEUVD-2008-1047 No score

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Record
EUVD-2008-1047
Updated
2026-11-03
GitHub AdvisoriesGHSA-w398-xcxp-rxmr No score

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat...

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Record
GHSA-w398-xcxp-rxmr
Weakness
CWE-79
Updated
2026-11-02
OSV No score

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Record
CVE-2008-1036
Updated
2026-11-02
OSVDEBIAN-CVE-2008-1036 No score

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Record
DEBIAN-CVE-2008-1036
Updated
2026-11-02
OSVopenSUSE-SU-2024:10859-1 No score

icu-69.1-2.3 on GA media

These are all security issues fixed in the icu-69.1-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10859-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icu
Debian:12
 before 4.0.1-1
4.0.1-1
icu
Debian:13
 before 4.0.1-1
4.0.1-1
icu
Debian:14
 before 4.0.1-1
4.0.1-1
icu
Debian:4.0
 before 3.6-2etch2, plus listed versions
3.6-23.6-2etch1
3.6-2etch2
icu
Debian:5.0
 before 3.8.1-3+lenny1, plus listed versions
3.8.1-3
3.8.1-3+lenny1
icu
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.6-5.11.2
0:3.6-5.11.2
icu-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.6-5.11.2
0:3.6-5.11.2
libicu-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.6-5.11.2
0:3.6-5.11.2
icu
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.11.2
0:3.6-5.11.2
icu-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.11.2
0:3.6-5.11.2
Show 8 moreShow less
Affected packages
PackageAffectedFixed
libicu
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.11.2
0:3.6-5.11.2
libicu-doc
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.11.2
0:3.6-5.11.2
icu
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.11.2
0:3.6-5.11.2
icu-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.11.2
0:3.6-5.11.2
libicu
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.11.2
0:3.6-5.11.2
libicu-devel
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.11.2
0:3.6-5.11.2
libicu-doc
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.11.2
0:3.6-5.11.2
icu
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 69.1-2.3
69.1-2.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-1036 is a medium vulnerability (CVSS 4.3) in Apple Mac Os X, published June 2, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. Fixed in icu 4.0.1-1.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open