{"id":"CVE-2016-7415","aliases":["ALPINE-CVE-2016-7415","BELL-CVE-2016-7415","DEBIAN-CVE-2016-7415","DLA-744-1","DSA-3725-1","EUVD-2016-8268","GHSA-7xfm-mgrj-8566","MGASA-2016-0404","UBUNTU-CVE-2016-7415","USN-3227-1"],"status":"published","title":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components...","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05798,"percentile":0.93171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-09-17T00:00:00Z","modified":"2026-10-24T10:30:46Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"icu","fixed_in":["57.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"icu","fixed_in":["58.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"icu","fixed_in":["57.1-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icu","fixed_in":["57.1-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icu","fixed_in":["57.1-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"icu","fixed_in":["52.1-3ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"icu","fixed_in":["55.1-7ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.1-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-5"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1.1-12+deb7u6"}]}],"versions":["4.8.1.1-12","4.8.1.1-12+deb7u1","4.8.1.1-12+deb7u2","4.8.1.1-12+deb7u3","4.8.1.1-12+deb7u4","4.8.1.1-12+deb7u5"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8+deb8u4"}]}],"versions":["52.1-8","52.1-8+deb8u2","52.1-8+deb8u3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.1-12.6.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.5"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3","52.1-3ubuntu0.2","52.1-3ubuntu0.3","52.1-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-7ubuntu0.1"}]}],"versions":["55.1-4ubuntu1","55.1-6ubuntu1","55.1-7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.5"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3","52.1-3ubuntu0.2","52.1-3ubuntu0.3","52.1-3ubuntu0.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-7ubuntu0.1"}]}],"versions":["55.1-4ubuntu1","55.1-6ubuntu1","55.1-7"],"bundled":5}],"products":[{"vendor":"icu-project","product":"international_components_for_unicode"}],"references":[{"url":"https://bugs.php.net/bug.php?id=73007","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/15/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/201701-58","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2016-19","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/93022","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7415"},{"url":"https://github.com/advisories/GHSA-7xfm-mgrj-8566"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-7415","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-7415","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7415","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0404.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19840","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/11/25/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OAJGWQ3FEZJMVTFPJHKJJPCUKMX7XBTX/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7415","tags":["report"]},{"url":"http://source.icu-project.org/repos/icu/icu/trunk/source/common/locid.cpp","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3227-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6293","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T21:00:00Z","modified":"2024-08-06T01:57:47.613Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-8268","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T21:00:00Z","modified":"2024-08-06T01:57:47Z","updated_at":"2026-11-03T02:22:32.939633Z"}],"ghsa":[{"id":"GHSA-7xfm-mgrj-8566","title":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components...","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2022-05-14T01:07:15Z","modified":"2023-02-02T05:03:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:34.49846Z"}],"nvd":[{"id":"CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T21:59:07.09Z","modified":"2026-06-17T00:53:01.4Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"ALPINE-CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T21:59:07.09Z","modified":"2026-09-22T06:17:50.233331691Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-7415","title":"CVE-2016-7415 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:18.105942Z","modified":"2026-02-18T07:35:12.27378Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T21:59:07.09Z","modified":"2026-10-24T10:30:46.763545363Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T21:59:07.09Z","modified":"2026-09-22T07:00:35.046752592Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.","status":"published","published":"2016-09-17T00:00:00Z","modified":"2026-04-22T10:56:12.052751Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-744-1","title":"icu - security update","status":"published","published":"2016-12-16T00:00:00Z","modified":"2026-03-09T02:10:43.13507Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3725-1","title":"icu - security update","status":"published","published":"2016-11-27T00:00:00Z","modified":"2026-03-09T01:23:12.411495Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0404","title":"Updated icu packages fix security vulnerability","description":"Stack overflow in ures_getByKeyWithFallback() in ICU before 54.1 could\nlead to a crash (CVE-2014-9911).\n\nIt was found that a big locale string causes a stack based overflow\ninside libicu in locid.cpp (CVE-2016-7415)\n","status":"published","published":"2016-11-27T12:34:14Z","modified":"2026-04-16T06:22:38.192973625Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-3227-1","title":"icu vulnerabilities","description":"It was discovered that ICU incorrectly handled certain memory operations\nwhen processing data. If an application using ICU processed crafted data,\na remote attacker could possibly cause it to crash or potentially execute\narbitrary code with the privileges of the user invoking the program.\n","status":"published","published":"2017-03-13T16:42:15Z","modified":"2026-04-22T09:33:33.804762Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}