CVE-2011-4599
Fixed in a distro release EPSS 8%
Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
Products: icu-project international_components_for_unicode
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | icu | 4.8.1.1-3 |
| Debian 13 | icu | 4.8.1.1-3 |
| Debian 14 | icu | 4.8.1.1-3 |
| Debian 5.0 | icu | 3.8.1-3+lenny3 |
| Debian 6.0 | icu | 4.4.1-8 |
| Red Hat Enterprise Linux 5 | icu | 0:3.6-5.16.1 |
| Red Hat Enterprise Linux 5 | icu-debuginfo | 0:3.6-5.16.1 |
| Red Hat Enterprise Linux 5 | libicu | 0:3.6-5.16.1 |
| Red Hat Enterprise Linux 5 | libicu-devel | 0:3.6-5.16.1 |
| Red Hat Enterprise Linux 5 | libicu-doc | 0:3.6-5.16.1 |
| Red Hat Enterprise Linux 6 | icu | 0:4.2.1-9.1.el6_2 |
| Red Hat Enterprise Linux 6 | icu-debuginfo | 0:4.2.1-9.1.el6_2 |
| Red Hat Enterprise Linux 6 | libicu | 0:4.2.1-9.1.el6_2 |
| Red Hat Enterprise Linux 6 | libicu-devel | 0:4.2.1-9.1.el6_2 |
| Red Hat Enterprise Linux 6 | libicu-doc | 0:4.2.1-9.1.el6_2 |