CVE-2014-9911: Buffer Overflow
A locale string of more than 255 characters passed to ulocgetDisplayName() could overflow a buffer on the stack, leading a crash or, potentially, code execution.
Upstream patch:
http://bugs.icu-project.org/trac/changeset/35699
Upstream issue (private as at 2016-10-11):
http://bugs.icu-project.org/trac/ticket/10891
Other sources
Stack-based buffer overflow in the uresgetByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted ulocgetDisplayName call.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9911?
CVE-2014-9911 is considered a high severity vulnerability due to the potential for code execution or crash.
How do I fix CVE-2014-9911?
To fix CVE-2014-9911, update the ICU package to version 54.1 or later.
What platforms are affected by CVE-2014-9911?
CVE-2014-9911 affects versions of the ICU libraries up to 54.1 across various platforms.
What is CVE-2014-9911?
CVE-2014-9911 is a vulnerability that allows a buffer overflow due to locale strings exceeding 255 characters.
Can CVE-2014-9911 lead to data compromise?
Yes, CVE-2014-9911 can potentially lead to data compromise through unauthorized code execution.