Every CVE Search/ Get API key

CVE-2011-4599

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International...

7.5 HighFix available

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Exploit likelihood

7.91%Down 4.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Record
CVE-2011-4599
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Record
CVE-2011-4599
Updated
2026-11-02
EUVDEUVD-2011-4523 No score

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Record
EUVD-2011-4523
Updated
2026-11-03
GitHub AdvisoriesGHSA-95hv-27rj-qc2p No score

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International...

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Record
GHSA-95hv-27rj-qc2p
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Record
CVE-2011-4599
Updated
2026-11-02
OSVDEBIAN-CVE-2011-4599 No score

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Record
DEBIAN-CVE-2011-4599
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icu
Debian:12
 before 4.8.1.1-3
4.8.1.1-3
icu
Debian:13
 before 4.8.1.1-3
4.8.1.1-3
icu
Debian:14
 before 4.8.1.1-3
4.8.1.1-3
icu
Debian:6.0
 before 4.4.1-8, plus listed versions
4.4.1-7
4.4.1-8
icu
Debian:5.0
 before 3.8.1-3+lenny3, plus listed versions
3.8.1-33.8.1-3+lenny13.8.1-3+lenny2
3.8.1-3+lenny3
icu
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.16.1
0:3.6-5.16.1
icu-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.16.1
0:3.6-5.16.1
libicu
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.16.1
0:3.6-5.16.1
libicu-doc
Red Hat:enterprise_linux:5::client
 before 0:3.6-5.16.1
0:3.6-5.16.1
icu
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.6-5.16.1
0:3.6-5.16.1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
icu-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.6-5.16.1
0:3.6-5.16.1
libicu-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.6-5.16.1
0:3.6-5.16.1
icu
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.16.1
0:3.6-5.16.1
icu-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.16.1
0:3.6-5.16.1
libicu
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.16.1
0:3.6-5.16.1
libicu-devel
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.16.1
0:3.6-5.16.1
libicu-doc
Red Hat:enterprise_linux:5::server
 before 0:3.6-5.16.1
0:3.6-5.16.1
icu
Red Hat:enterprise_linux:6::client
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu
Red Hat:enterprise_linux:6::client
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-devel
Red Hat:enterprise_linux:6::client
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-doc
Red Hat:enterprise_linux:6::client
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu
Red Hat:enterprise_linux:6::computenode
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu
Red Hat:enterprise_linux:6::computenode
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-devel
Red Hat:enterprise_linux:6::computenode
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-doc
Red Hat:enterprise_linux:6::computenode
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu
Red Hat:enterprise_linux:6::server
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu
Red Hat:enterprise_linux:6::server
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-devel
Red Hat:enterprise_linux:6::server
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-doc
Red Hat:enterprise_linux:6::server
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu
Red Hat:enterprise_linux:6::workstation
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
icu-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu
Red Hat:enterprise_linux:6::workstation
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-devel
Red Hat:enterprise_linux:6::workstation
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2
libicu-doc
Red Hat:enterprise_linux:6::workstation
 before 0:4.2.1-9.1.el6_2
0:4.2.1-9.1.el6_2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4599 is a high vulnerability (CVSS 7.5) in Icu-project International Components For Unicode, published January 29, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.91%, the 94th percentile. Fixed in icu 4.8.1.1-3.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open