Every CVE Search/ Get API key

CVE-2014-9911

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in...

9.8 CriticalFix available

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.56%Up 4.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
CVE-2014-9911
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
CVE-2014-9911
Updated
2026-11-02
EUVDEUVD-2014-9716 No score

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
EUVD-2014-9716
Updated
2026-11-03
GitHub AdvisoriesGHSA-968j-j287-m7jc 9.8

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in...

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
GHSA-968j-j287-m7jc
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 9.8

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
CVE-2014-9911
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9911 9.8

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
DEBIAN-CVE-2014-9911
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2014-9911 9.8

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Record
UBUNTU-CVE-2014-9911
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0404 No score

Updated icu packages fix security vulnerability

Stack overflow in ures_getByKeyWithFallback() in ICU before 54.1 could lead to a crash (CVE-2014-9911).

It was found that a big locale string causes a stack based overflow inside libicu in locid.cpp (CVE-2016-7415)

Record
MGASA-2016-0404
Updated
2026-11-02
OSVSUSE-RU-2018:0028-1 No score

Recommended update for icu

This update for icu fixes the following issue:

  • Fix international date/time format output (a regression caused by the fix for CVE-2014-9911) (bsc#1037416).
Record
SUSE-RU-2018:0028-1
Updated
2026-11-02
OSVSUSE-SU-2017:0256-1 No score

Security update for icu

This update for icu fixes the following security issues:

  • Passing a locale string longer than 255 characters to uloc_getDisplayName() could have caused a buffer overflow resulting in denial of service or possible code execution (bsc#1012224, CVE-2014-9911).
Record
SUSE-SU-2017:0256-1
Updated
2026-11-02
OSVUSN-3227-1 No score

icu vulnerabilities

It was discovered that ICU incorrectly handled certain memory operations when processing data. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.

Record
USN-3227-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icu
Debian:12
 before 55.1-3
55.1-3
icu
Debian:13
 before 55.1-3
55.1-3
icu
Debian:14
 before 55.1-3
55.1-3
icu
Debian:7
 before 4.8.1.1-12+deb7u6, plus listed versions
4.8.1.1-124.8.1.1-12+deb7u14.8.1.1-12+deb7u24.8.1.1-12+deb7u34.8.1.1-12+deb7u44.8.1.1-12+deb7u5
4.8.1.1-12+deb7u6
icu
Debian:8
 before 52.1-8+deb8u4, plus listed versions
52.1-852.1-8+deb8u252.1-8+deb8u3
52.1-8+deb8u4
icu
Mageia:5
 before 53.1-12.6.mga5
53.1-12.6.mga5
icu
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 4.0-47.3.2
4.0-47.3.2
icu
SUSE:Linux Enterprise Server 11 SP4
 before 4.0-47.3.2
4.0-47.3.2
icu
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 4.0-47.3.2
4.0-47.3.2
icu
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 4.0-43.1
4.0-43.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
icu
SUSE:Linux Enterprise Server 11 SP4
 before 4.0-43.1
4.0-43.1
icu
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 4.0-43.1
4.0-43.1
icu
Ubuntu:14.04:LTS
 before 52.1-3ubuntu0.5, plus listed versions
4.8.1.1-12ubuntu24.8.1.1-13+nmu14.8.1.1-13+nmu1ubuntu152.1-352.1-3ubuntu0.252.1-3ubuntu0.352.1-3ubuntu0.4
52.1-3ubuntu0.5
android
Ubuntu:16.04:LTS
 All versions, plus listed versions
20150818-1500-0ubuntu220150818-1500-0ubuntu320160307-0742-0ubuntu320160330-0939-0ubuntu1
 None known
mozjs24
Ubuntu:16.04:LTS
 All versions, plus listed versions
24.2.0-3ubuntu124.2.0-3ubuntu224.2.0-3ubuntu2.1
 None known
icu
Ubuntu:16.04:LTS
 before 55.1-7ubuntu0.1, plus listed versions
55.1-4ubuntu155.1-6ubuntu155.1-7
55.1-7ubuntu0.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9911 is a critical vulnerability (CVSS 9.8) in Icu-project International Components For Unicode, published November 27, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.56%, the 92nd percentile. Fixed in icu 55.1-3.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open