CVE-2014-9911
Fixed in a distro release EPSS 6%
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.
Products: icu-project international_components_for_unicode
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | icu | 55.1-3 |
| Debian 13 | icu | 55.1-3 |
| Debian 14 | icu | 55.1-3 |
| Debian 7 | icu | 4.8.1.1-12+deb7u6 |
| Debian 8 | icu | 52.1-8+deb8u4 |
| SUSE Linux Enterprise Server 11 SP4 | icu | 4.0-47.3.2 |
| SUSE Linux Enterprise Server 11 SP4 | icu | 4.0-43.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | icu | 4.0-47.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | icu | 4.0-43.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | icu | 4.0-47.3.2 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | icu | 4.0-43.1 |
| Ubuntu 14.04 LTS | icu | 52.1-3ubuntu0.5 |
| Ubuntu 16.04 LTS | android | no fix |
| Ubuntu 16.04 LTS | icu | 55.1-7ubuntu0.1 |
| Ubuntu 16.04 LTS | mozjs24 | no fix |