CVE-2011-4599: Buffer Overflow
International Components for Unicode is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the canonicalize( ) function. By supplying a negative len value, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Other sources
Stack-based buffer overflow in the canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4599?
CVE-2011-4599 has a high severity level due to its potential for remote code execution.
How do I fix CVE-2011-4599?
To fix CVE-2011-4599, update the International Components for Unicode to a version greater than 49.1.
What versions of International Components for Unicode are affected by CVE-2011-4599?
CVE-2011-4599 affects versions up to but not including 49.1 of the International Components for Unicode.
What type of vulnerability is CVE-2011-4599?
CVE-2011-4599 is classified as a stack-based buffer overflow vulnerability.
Can CVE-2011-4599 be exploited remotely?
Yes, CVE-2011-4599 can be exploited remotely, allowing an attacker to execute arbitrary code.