CVE-2016-7415: Buffer Overflow
International Components for Unicode (ICU) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Locale class in common/locid.cpp. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Other sources
It was found that big locale string causes stack based overflow inside libicu.
PHP bug:
https://bugs.php.net/bug.php?id=73007
CVE assignment:
http://seclists.org/oss-sec/2016/q3/518
Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7415?
CVE-2016-7415 is considered critical due to its potential for remote code execution.
How do I fix CVE-2016-7415?
To mitigate CVE-2016-7415, update to ICU version 58.1 or later.
Which versions of ICU are affected by CVE-2016-7415?
CVE-2016-7415 affects ICU versions prior to 58.1 and from 57.1 and earlier.
Can CVE-2016-7415 be exploited remotely?
Yes, CVE-2016-7415 can be exploited remotely by sending an overly long string.
What type of vulnerability is CVE-2016-7415?
CVE-2016-7415 is a stack-based buffer overflow vulnerability.