{"id":"CVE-2017-7867","aliases":["ALPINE-CVE-2017-7867","BELL-CVE-2017-7867","DEBIAN-CVE-2017-7867","DLA-947-1","DSA-3830-1","EUVD-2017-16842","GHSA-4p33-mgp9-vqp5","MGASA-2017-0116","SUSE-SU-2018:1401-1","SUSE-SU-2018:1401-2","SUSE-SU-2018:1602-1","UBUNTU-CVE-2017-7867","USN-3274-1"],"status":"published","title":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write...","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0463,"percentile":0.91768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-04-14T00:00:00Z","modified":"2026-10-24T10:30:24Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.2","package":"icu","fixed_in":["55.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"icu","fixed_in":["56.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"icu","fixed_in":["57.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"icu","fixed_in":["57.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"icu","fixed_in":["58.2-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"icu","fixed_in":["57.1-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icu","fixed_in":["57.1-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icu","fixed_in":["57.1-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"icu","fixed_in":["52.1-3ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"icu","fixed_in":["55.1-7ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"56.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.2-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"57.1-6"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1.1-12+deb7u7"}]}],"versions":["4.8.1.1-12","4.8.1.1-12+deb7u1","4.8.1.1-12+deb7u2","4.8.1.1-12+deb7u3","4.8.1.1-12+deb7u4","4.8.1.1-12+deb7u5","4.8.1.1-12+deb7u6"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8+deb8u5"}]}],"versions":["52.1-8","52.1-8+deb8u2","52.1-8+deb8u3","52.1-8+deb8u4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.1-12.7.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-8.7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-47.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-47.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-47.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.6"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3","52.1-3ubuntu0.2","52.1-3ubuntu0.3","52.1-3ubuntu0.4","52.1-3ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-7ubuntu0.2"}]}],"versions":["55.1-4ubuntu1","55.1-6ubuntu1","55.1-7","55.1-7ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.6"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3","52.1-3ubuntu0.2","52.1-3ubuntu0.3","52.1-3ubuntu0.4","52.1-3ubuntu0.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-7ubuntu0.2"}]}],"versions":["55.1-4ubuntu1","55.1-6ubuntu1","55.1-7","55.1-7ubuntu0.1"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"icu-project","product":"international_components_for_unicode"}],"references":[{"url":"http://bugs.icu-project.org/trac/changeset/39671","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"http://www.debian.org/security/2017/dsa-3830","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=213","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201710-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/97672","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7867"},{"url":"https://github.com/advisories/GHSA-4p33-mgp9-vqp5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-7867","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-7867","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7867","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0116.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20706","tags":["report"]},{"url":"https://www.debian.org/security/2017/dsa-3830","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181401-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034674","tags":["report"]},{"url":"https://bugzilla.suse.com/1034678","tags":["report"]},{"url":"https://bugzilla.suse.com/1067203","tags":["report"]},{"url":"https://bugzilla.suse.com/1072193","tags":["report"]},{"url":"https://bugzilla.suse.com/1077999","tags":["report"]},{"url":"https://bugzilla.suse.com/1087932","tags":["report"]},{"url":"https://bugzilla.suse.com/929629","tags":["report"]},{"url":"https://bugzilla.suse.com/990636","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7868","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181401-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181602-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-7867","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3274-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3274-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7868","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7867","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T04:30:00Z","modified":"2024-08-05T16:19:29.32Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16842","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T04:30:00Z","modified":"2024-08-05T16:19:29Z","updated_at":"2026-11-03T02:39:07.019497Z"}],"ghsa":[{"id":"GHSA-4p33-mgp9-vqp5","title":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write...","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2022-05-14T01:07:11Z","modified":"2023-02-02T05:03:05Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:51:33.931227Z"}],"nvd":[{"id":"CVE-2017-7867","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T04:59:00.65Z","modified":"2026-06-17T01:25:22.313Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"ALPINE-CVE-2017-7867","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T04:59:00.65Z","modified":"2026-06-15T18:18:07.097337719Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2017-7867","title":"CVE-2017-7867 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:30.64455Z","modified":"2026-02-18T07:38:20.706141Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-7867","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T04:59:00.65Z","modified":"2026-10-24T10:30:24.261609755Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-7867","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T04:59:00.65Z","modified":"2026-09-01T20:03:50.614386339Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-7867","description":"International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.","status":"published","published":"2017-04-14T00:00:00Z","modified":"2026-04-22T11:33:38.998116Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-947-1","title":"icu - security update","status":"published","published":"2017-05-20T00:00:00Z","modified":"2026-03-09T02:09:10.946132Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3830-1","title":"icu - security update","status":"published","published":"2017-04-19T00:00:00Z","modified":"2026-03-09T01:22:08.676567Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0116","title":"Updated icu packages fix security vulnerability","description":"It was discovered that icu did not correctly validate its input. An\nattacker could use this problem to trigger an out-of-bound write through a\nheap-based buffer overflow, thus causing a denial of service via\napplication crash, or potential execution of arbitrary code\n(CVE-2017-7867, CVE-2017-7868).\n","status":"published","published":"2017-04-24T07:27:32Z","modified":"2026-04-16T06:22:56.101482646Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2018:1401-1","title":"Security update for icu","description":"icu was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c\n  in the Unicode Bidirectional Algorithm implementation in ICU4C in\n  International Components for Unicode (ICU) used an integer data type\n  that is inconsistent with a header file, which allowed remote attackers\n  to cause a denial of service (incorrect malloc followed by invalid free)\n  or possibly execute arbitrary code via crafted text (bsc#929629).\n- CVE-2014-8146: The resolveImplicitLevels function in common/ubidi.c\n  in the Unicode Bidirectional Algorithm implementation in ICU4C in\n  International Components for Unicode (ICU) did not properly track\n  directionally isolated pieces of text, which allowed remote attackers\n  to cause a denial of service (heap-based buffer overflow) or possibly\n  execute arbitrary code via crafted text (bsc#929629).\n- CVE-2016-6293: The uloc_acceptLanguageFromHTTP function in\n  common/uloc.cpp in International Components for Unicode (ICU) for C/C++\n  did not ensure that there is a '\\0' character at the end of a certain\n  temporary array, which allowed remote attackers to cause a denial of\n  service (out-of-bounds read) or possibly have unspecified other impact\n  via a call with a long httpAcceptLanguage argument (bsc#990636).\n- CVE-2017-7868: International Components for Unicode (ICU) for C/C++\n  2017-02-13 has an out-of-bounds write caused by a heap-based buffer\n  overflow related to the utf8TextAccess function in common/utext.cpp and\n  the utext_moveIndex32* function (bsc#1034674)\n- CVE-2017-7867: International Components for Unicode (ICU) for C/C++\n  2017-02-13 has an out-of-bounds write caused by a heap-based buffer\n  overflow related to the utf8TextAccess function in common/utext.cpp and\n  the utext_setNativeIndex* function (bsc#1034678)\n- CVE-2017-14952: Double free in i18n/zonemeta.cpp in International\n  Components for Unicode (ICU) for C/C++ allowed remote attackers to\n  execute arbitrary code via a crafted string, aka a 'redundant UVector\n  entry clean up function call' issue (bnc#1067203)\n- CVE-2017-17484: The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp\n  in International Components for Unicode (ICU) for C/C++ mishandled\n  ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allowed remote\n  attackers to cause a denial of service (stack-based buffer overflow\n  and application crash) or possibly have unspecified other impact via a\n  crafted string, as demonstrated by ZNC  (bnc#1072193)\n- CVE-2017-15422: An integer overflow in icu during persian calendar\n  date processing could lead to incorrect years shown (bnc#1077999)\n\n","status":"published","published":"2018-05-23T17:53:04Z","modified":"2026-02-04T04:26:05.827503Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1401-2","title":"Security update for icu","description":"icu was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c\n  in the Unicode Bidirectional Algorithm implementation in ICU4C in\n  International Components for Unicode (ICU) used an integer data type\n  that is inconsistent with a header file, which allowed remote attackers\n  to cause a denial of service (incorrect malloc followed by invalid free)\n  or possibly execute arbitrary code via crafted text (bsc#929629).\n- CVE-2014-8146: The resolveImplicitLevels function in common/ubidi.c\n  in the Unicode Bidirectional Algorithm implementation in ICU4C in\n  International Components for Unicode (ICU) did not properly track\n  directionally isolated pieces of text, which allowed remote attackers\n  to cause a denial of service (heap-based buffer overflow) or possibly\n  execute arbitrary code via crafted text (bsc#929629).\n- CVE-2016-6293: The uloc_acceptLanguageFromHTTP function in\n  common/uloc.cpp in International Components for Unicode (ICU) for C/C++\n  did not ensure that there is a '\\0' character at the end of a certain\n  temporary array, which allowed remote attackers to cause a denial of\n  service (out-of-bounds read) or possibly have unspecified other impact\n  via a call with a long httpAcceptLanguage argument (bsc#990636).\n- CVE-2017-7868: International Components for Unicode (ICU) for C/C++\n  2017-02-13 has an out-of-bounds write caused by a heap-based buffer\n  overflow related to the utf8TextAccess function in common/utext.cpp and\n  the utext_moveIndex32* function (bsc#1034674)\n- CVE-2017-7867: International Components for Unicode (ICU) for C/C++\n  2017-02-13 has an out-of-bounds write caused by a heap-based buffer\n  overflow related to the utf8TextAccess function in common/utext.cpp and\n  the utext_setNativeIndex* function (bsc#1034678)\n- CVE-2017-14952: Double free in i18n/zonemeta.cpp in International\n  Components for Unicode (ICU) for C/C++ allowed remote attackers to\n  execute arbitrary code via a crafted string, aka a 'redundant UVector\n  entry clean up function call' issue (bnc#1067203)\n- CVE-2017-17484: The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp\n  in International Components for Unicode (ICU) for C/C++ mishandled\n  ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allowed remote\n  attackers to cause a denial of service (stack-based buffer overflow\n  and application crash) or possibly have unspecified other impact via a\n  crafted string, as demonstrated by ZNC  (bnc#1072193)\n- CVE-2017-15422: An integer overflow in icu during persian calendar\n  date processing could lead to incorrect years shown (bnc#1077999)\n\n","status":"published","published":"2018-10-18T12:43:53Z","modified":"2026-02-04T02:42:02.22316Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1602-1","title":"Security update for icu","description":"This update for icu fixes the following issues:\n\n- CVE-2016-6293: The uloc_acceptLanguageFromHTTP function in common/uloc.cpp did not ensure that there is a '\\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument. (bsc#990636)\n- CVE-2017-7868: ICU had an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function. (bsc#1034674)\n- CVE-2017-7867: ICU had an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function. (bsc#1034678)\n- CVE-2017-14952: Double free in i18n/zonemeta.cpp allowed remote attackers to execute arbitrary code via a crafted string, aka a 'redundant UVector entry clean up function call' issue. (bsc#1067203)\n- CVE-2017-17484:The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp mishandled ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC. (bsc#1072193)\n- CVE-2017-15422: An integer overflow in persian calendar calculation was fixed, which could show wrong years. (bsc#1077999)\n","status":"published","published":"2018-06-08T09:39:04Z","modified":"2026-02-04T04:31:56.232103Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3274-1","title":"icu vulnerabilities","description":"It was discovered that ICU incorrectly handled certain memory operations\nwhen processing data. If an application using ICU processed crafted data,\na remote attacker could possibly cause it to crash or potentially execute\narbitrary code with the privileges of the user invoking the program.\n","status":"published","published":"2017-05-02T18:23:41Z","modified":"2026-04-22T09:35:10.224245Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}