CVE-2016-6293

Critical

Description

The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.

SeverityCritical

CVSS9.8

Exploit probability—

ProductIcu-project International Components For Unicode

PublishedJul 25, 2016

First seenJul 25, 2016

How to fix

Vendor advisories

security.gentoo.org/glsa/201701-58

Affected products

Product	Affected versions	Fixed in
icu-project international_components_for_unicode	v ≤ 57.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.