CVE-2020-10531 - 漏洞详情

CVE-2020-10531 (CNNVD-202003-786)

HIGH

中文标题:

IBM International Components for Unicode 输入验证错误漏洞

英文标题:

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An int...

CVSS分数: 8.8

发布时间: 2020-03-12 18:09:40

漏洞类型: 输入验证错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

IBM International Components for Unicode（ICU）是美国IBM公司的一个为C/C++和Java编程语言提供了一整套操作Unicode数据的函数库，也是一个用于支持软件国际化的开源项目。 IBM International Components for Unicode（ICU） 66.1及之前版本中的common/unistr.cpp文件的‘UnicodeString::doAppend()’函数存在输入验证错误漏洞。攻击者可利用该漏洞执行任意代码，或者导致应用程序崩溃。

英文描述:

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CWE类型:

CWE-190 CWE-787

受影响产品

厂商	产品	版本	版本范围	平台	CPE
icu-project	international_components_for_unicode	*	-	-	`cpe:2.3:a:icu-project:international_components_for_unicode::::::c\/c\+\+::*`
redhat	enterprise_linux_desktop	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_workstation	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`
google	chrome	*	-	-	`cpe:2.3:a:google:chrome::::::::`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
fedoraproject	fedora	31	-	-	`cpe:2.3:o:fedoraproject:fedora:31:::::::*`
fedoraproject	fedora	33	-	-	`cpe:2.3:o:fedoraproject:fedora:33:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
canonical	ubuntu_linux	12.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::`
canonical	ubuntu_linux	14.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	19.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*`
opensuse	leap	15.1	-	-	`cpe:2.3:o:opensuse:leap:15.1:::::::*`
oracle	banking_extensibility_workbench	14.3.0	-	-	`cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:::::::*`
oracle	banking_extensibility_workbench	14.4.0	-	-	`cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:::::::*`
nodejs	node.js	*	-	-	`cpe:2.3:a:nodejs:node.js:::::-:::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2020:0738 vendor-advisory
cve.org

访问

GLSA-202003-15 vendor-advisory
cve.org

访问

FEDORA-2020-f6271d7afa vendor-advisory
cve.org

访问

[debian-lts-announce] 20200320 [SECURITY] [DLA 2151-1] icu security update mailing-list
cve.org

访问

DSA-4646 vendor-advisory
cve.org

访问

FEDORA-2020-39e0b8bd14 vendor-advisory
cve.org

访问

USN-4305-1 vendor-advisory
cve.org

访问

openSUSE-SU-2020:0459 vendor-advisory
cve.org

访问

FEDORA-2020-43d5a372fc vendor-advisory
cve.org

访问