vendor:
ICU Library
by:
Pedro Ribeiro
7.5
CVSS
HIGH
Heap overflow and Integer overflow
119, 190
CWE
Product Name: ICU Library
Affected Version From: v52
Affected Version To: v54
Patch Exists: YES
Related CWE: CVE-2014-8146, CVE-2014-8147
CPE: a:icu-project:icu
Metasploit:
https://www.rapid7.com/db/vulnerabilities/apple-ios-cve-2014-8146/, https://www.rapid7.com/db/vulnerabilities/apple-itunes-cve-2014-8146/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2014-8146/, https://www.rapid7.com/db/vulnerabilities/apple-osx-icu-cve-2014-8146/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2014-8146/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-8146/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2014-8147/, https://www.rapid7.com/db/vulnerabilities/apple-itunes-cve-2014-8147/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2014-8147/, https://www.rapid7.com/db/vulnerabilities/apple-osx-icu-cve-2014-8147/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-8147/
Other Scripts:
N/A
Platforms Tested: C/C++ and Java
2015
Heap overflow and integer overflow in ICU library (v52 to v54)
While fuzzing LibreOffice an integer overflow and a heap overflow were found in the ICU library. This library is used by LibreOffice and hundreds of other software packages. Proof of concept files can be downloaded from [1]. These files have been tested with LibreOffice 4.3.3.2 and LibreOffice 4.4.0-beta2 and ICU 52. Under certain conditions isolateCount is incremented too many times, which results in several out of bounds writes. The overflow is on the resolveImplicitLevels function (ubidi.c:2248): pBiDi->isolates[pBiDi->isolateCount].state=levState.state; pBiDi->isolates[].state is a int16, while levState.state is a int3. This results in an integer overflow.
Mitigation:
Update to the latest version of ICU library.
