VulnerabilityModified
CVE-2007-4770
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory…
MEDIUM 6.8EPSS 2.93%
Does this matter?
Lower severity and a low EPSS score (2.93%). Track it; it rarely justifies an emergency change on its own.
Description
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.93% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- icu-project/international components for unicode
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2008-0090.htmlThird Party Advisory
- http://secunia.com/advisories/28575Permissions Required
- http://secunia.com/advisories/28615Permissions Required
- http://secunia.com/advisories/28669Permissions Required
- http://secunia.com/advisories/28783Permissions Required
- http://secunia.com/advisories/29194Permissions Required
- http://secunia.com/advisories/29242Permissions Required
- http://secunia.com/advisories/29291Permissions Required
- http://secunia.com/advisories/29294Permissions Required
- http://secunia.com/advisories/29333Permissions Required
- http://secunia.com/advisories/29852Permissions Required
- http://secunia.com/advisories/29910Permissions Required
- http://secunia.com/advisories/29987Permissions Required
- http://secunia.com/advisories/30179Permissions Required
- http://security.gentoo.org/glsa/glsa-200803-20.xmlThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200805-16.xmlThird Party Advisory
- http://securitytracker.com/id?1019269Third Party Advisory, VDB Entry
- http://sourceforge.net/mailarchive/message.php?msg_name=d03a2ffb0801221538x68825e42xb4a4aaf0fcccecbd%40mail.gmail.comBroken Link, Patch, Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-231641-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-233922-1Broken Link
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0043Third Party Advisory
- http://www.debian.org/security/2008/dsa-1511Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:026Broken Link
- http://www.novell.com/linux/security/advisories/2008_23_openoffice.htmlThird Party Advisory
- http://www.openoffice.org/security/cves/CVE-2007-4770.htmlThird Party Advisory
- http://www.openoffice.org/security/cves/CVE-2007-5745.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/487677/100/0/threaded
- http://www.securityfocus.com/bid/27455Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-591-1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.