{"id":"CVE-2014-9911","aliases":["DEBIAN-CVE-2014-9911","DLA-744-1","DSA-3725-1","EUVD-2014-9716","GHSA-968j-j287-m7jc","MGASA-2016-0404","SUSE-RU-2018:0028-1","SUSE-SU-2017:0256-1","UBUNTU-CVE-2014-9911","USN-3227-1"],"status":"published","title":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in...","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05563,"percentile":0.92917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-11-27T00:00:00Z","modified":"2026-10-23T16:00:52Z","fixes":[{"ecosystem":"Debian:12","package":"icu","fixed_in":["55.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icu","fixed_in":["55.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icu","fixed_in":["55.1-3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","fixed_in":["4.0-47.3.2","4.0-43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","fixed_in":["4.0-47.3.2","4.0-43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","fixed_in":["4.0-47.3.2","4.0-43.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"icu","fixed_in":["52.1-3ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1.1-12+deb7u6"}]}],"versions":["4.8.1.1-12","4.8.1.1-12+deb7u1","4.8.1.1-12+deb7u2","4.8.1.1-12+deb7u3","4.8.1.1-12+deb7u4","4.8.1.1-12+deb7u5"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8+deb8u4"}]}],"versions":["52.1-8","52.1-8+deb8u2","52.1-8+deb8u3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.1-12.6.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-47.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-47.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-47.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-43.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.5"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3","52.1-3ubuntu0.2","52.1-3ubuntu0.3","52.1-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"android","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20150818-1500-0ubuntu2","20150818-1500-0ubuntu3","20160307-0742-0ubuntu3","20160330-0939-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mozjs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.2.0-3ubuntu1","24.2.0-3ubuntu2","24.2.0-3ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.5"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3","52.1-3ubuntu0.2","52.1-3ubuntu0.3","52.1-3ubuntu0.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-7ubuntu0.1"}]}],"versions":["55.1-4ubuntu1","55.1-6ubuntu1","55.1-7"],"bundled":5}],"products":[{"vendor":"icu-project","product":"international_components_for_unicode"}],"references":[{"url":"http://bugs.icu-project.org/trac/changeset/35699","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1383569","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","advisory","fix","report"]},{"url":"http://www.securitytracker.com/id/1037556","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/94520","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/11/25/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://bugs.php.net/bug.php?id=67397","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://bugs.icu-project.org/trac/ticket/1089","tags":["x_refsource_CONFIRM","x_transferred","Not Applicable","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9911"},{"url":"https://github.com/advisories/GHSA-968j-j287-m7jc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9911","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0404.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19840","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/11/25/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OAJGWQ3FEZJMVTFPJHKJJPCUKMX7XBTX/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20180028-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1037416","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9911","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170256-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9911","tags":["report"]},{"url":"http://bugs.icu-project.org/trac/ticket/10891","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3227-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7415","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9911","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2017-01-04T20:00:00Z","modified":"2024-08-06T14:02:37.743Z","updated_at":"2026-11-02T14:33:42.219637Z"}],"euvd":[{"id":"EUVD-2014-9716","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2017-01-04T20:00:00Z","modified":"2024-08-06T14:02:37Z","updated_at":"2026-11-03T01:56:47.514809Z"}],"ghsa":[{"id":"GHSA-968j-j287-m7jc","title":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in...","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2022-05-14T01:07:16Z","modified":"2023-02-02T05:03:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:34.49846Z"}],"nvd":[{"id":"CVE-2014-9911","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2017-01-04T20:59:00.137Z","modified":"2026-06-17T00:19:12.277Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-9911","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2017-01-04T20:59:00Z","modified":"2026-04-16T06:16:10.108188375Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9911","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2017-01-04T20:59:00.137Z","modified":"2026-10-23T16:00:52.90806714Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9911","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.","status":"published","published":"2017-01-04T00:00:00Z","modified":"2026-04-22T09:59:22.475004Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"DLA-744-1","title":"icu - security update","status":"published","published":"2016-12-16T00:00:00Z","modified":"2026-03-09T02:10:43.13507Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3725-1","title":"icu - security update","status":"published","published":"2016-11-27T00:00:00Z","modified":"2026-03-09T01:23:12.411495Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0404","title":"Updated icu packages fix security vulnerability","description":"Stack overflow in ures_getByKeyWithFallback() in ICU before 54.1 could\nlead to a crash (CVE-2014-9911).\n\nIt was found that a big locale string causes a stack based overflow\ninside libicu in locid.cpp (CVE-2016-7415)\n","status":"published","published":"2016-11-27T12:34:14Z","modified":"2026-04-16T06:22:38.192973625Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-RU-2018:0028-1","title":"Recommended update for icu","description":"\nThis update for icu fixes the following issue:\n\n- Fix international date/time format output (a regression caused by the fix for CVE-2014-9911) (bsc#1037416).\n","status":"published","published":"2018-01-05T12:58:00Z","modified":"2026-02-04T03:30:05.241014Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2017:0256-1","title":"Security update for icu","description":"\nThis update for icu fixes the following security issues:\n\n- Passing a locale string longer than 255 characters to uloc_getDisplayName()\n  could have caused a buffer overflow resulting in denial of service or\n  possible code execution (bsc#1012224, CVE-2014-9911).\n","status":"published","published":"2017-01-23T11:29:16Z","modified":"2026-02-04T02:41:48.243351Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3227-1","title":"icu vulnerabilities","description":"It was discovered that ICU incorrectly handled certain memory operations\nwhen processing data. If an application using ICU processed crafted data,\na remote attacker could possibly cause it to crash or potentially execute\narbitrary code with the privileges of the user invoking the program.\n","status":"published","published":"2017-03-13T16:42:15Z","modified":"2026-04-22T09:33:33.804762Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}