NVD

Id
35355  
Name
CVE-2014-8146  
Description
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-05-25  
Modified Date
2016-12-21  
Seq
2014-8146  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
181172 35355 CVE-2014-8146 http://bugs.icu-project.org/trac/changeset/37162  View
181173 35355 CVE-2014-8146 APPLE-SA-2015-09-16-1  View
181174 35355 CVE-2014-8146 APPLE-SA-2015-09-16-3  View
181175 35355 CVE-2014-8146 APPLE-SA-2015-09-21-1  View
181176 35355 CVE-2014-8146 APPLE-SA-2015-09-30-3  View
181177 35355 CVE-2014-8146 [oss-security] 20150505 [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL  View
181178 35355 CVE-2014-8146 20150505 [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL  View
181179 35355 CVE-2014-8146 DSA-3323  View
181180 35355 CVE-2014-8146 VU#602540  View
181181 35355 CVE-2014-8146 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html  View
181182 35355 CVE-2014-8146 http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html  View
181183 35355 CVE-2014-8146 74457  View
181184 35355 CVE-2014-8146 https://raw.githubusercontent.com/pedrib/PoC/master/generic/i-c-u-fail.txt  View
181185 35355 CVE-2014-8146 GLSA-201507-04  View
181186 35355 CVE-2014-8146 https://support.apple.com/HT205212  View
181187 35355 CVE-2014-8146 https://support.apple.com/HT205213  View
181188 35355 CVE-2014-8146 https://support.apple.com/HT205221  View
181189 35355 CVE-2014-8146 https://support.apple.com/HT205267  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19183 JVNDB-2014-008060 International Components for Unicode の ICU4C の Unicode 双方向アルゴリズムの実装におけるサービス運用妨害 (DoS) の脆弱性 International Components for Unicode (ICU) の ICU4C の Unicode 双方向アルゴリズムの実装の common/ubidi.c 内の resolveImplicitLevels 関数は、一方向に分離された (directionally isolated) テキストの部分を適切に追跡しないため、サービス運用妨害 (ヒープベースのバッファオーバーフロー) 状態にされる、または任意のコードを実行される脆弱性が存在します。 CVE-2014-8146 75439 CVE-2014-8146 35355 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008060.html 2014-10-10 2015-11-06 View