PatchTheCVEicu-project vulnerabilities
Recent CVEs affecting icu-project products. 10 tracked.
icu-project has 10 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 9. Most recent: 2020-03-12. Highest priority: CVE-2017-17484 (score 67/100).
- CVE-2020-10531 HIGH 8.8 UPGRADE MITIGATE An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1
- CVE-2018-18928 CRITICAL 9.8 DOWNGRADE International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuan
- CVE-2017-15422 MEDIUM 6.5 UPGRADE UPGRADE Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before
- CVE-2017-7868 HIGH 7.5 UPGRADE MITIGATE International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a
- CVE-2017-7867 HIGH 7.5 UPGRADE MITIGATE International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a
- CVE-2017-17484 CRITICAL 9.8 UPGRADE The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through
- CVE-2017-15396 MEDIUM 6.5 UPGRADE MITIGATE A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2
- CVE-2017-14952 CRITICAL 9.8 UPGRADE Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows r
- CVE-2014-9911 CRITICAL 9.8 UPGRADE Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International
- CVE-2014-9654 CRITICAL 9.8 UPGRADE UPGRADE The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as
FAQ
How do I fix icu-project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is icu-project being exploited right now?
None of the tracked icu-project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which icu-project CVE should I patch first?
CVE-2017-17484 currently ranks highest (67/100): The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through .