CVE-2016-6293

The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.

References

Affected packages

Git / github.com/unicode-org/icu

Affected ranges

Type

GIT

Repo

https://github.com/unicode-org/icu

Events

Introduced

Last affected

0c5873f89bf64f6bbc0a24b84f07d79b25785a42

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "57.1"
        }
    ],
    "cpe": "cpe:2.3:a:icu-project:international_components_for_unicode:*:*:*:*:*:c\\/c\\+\\+:*:*",
    "source": "CPE_FIELD"
}

Affected versions

Other

release-57-1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6293.json"