CVE-2007-4770
Fixed in a distro release EPSS 3%
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.
Products: icu-project international_components_for_unicode
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | icu | 3.8-6 |
| Debian 13 | icu | 3.8-6 |
| Debian 14 | icu | 3.8-6 |
| Debian 4.0 | icu | 3.6-2etch1 |
| Red Hat Enterprise Linux 5 | icu | 0:3.6-5.11.1 |
| Red Hat Enterprise Linux 5 | icu-debuginfo | 0:3.6-5.11.1 |
| Red Hat Enterprise Linux 5 | libicu | 0:3.6-5.11.1 |
| Red Hat Enterprise Linux 5 | libicu-devel | 0:3.6-5.11.1 |
| Red Hat Enterprise Linux 5 | libicu-doc | 0:3.6-5.11.1 |
| openSUSE Tumbleweed | icu | 69.1-2.3 |