CVE-2007-4770: Medium severity icu-project International Components For Unicode C\/c\+\+ vulnerability
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.
Other sources
Will Drewry reported a flaw in the way libicu processes certain regular expressions. He reports:
On regular expression compilation, illegal backreferences may refer to the non-existent capture group '0'. When these are builts, they will result in corrupt REStackFrames which will be used at a later point. Crashes may result in out of band reads or writes depending on the regular expression being executed.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4770?
CVE-2007-4770 is classified as a medium severity vulnerability due to potential memory corruption risks.
How do I fix CVE-2007-4770?
To fix CVE-2007-4770, upgrade to ICU version 3.8.2 or later, as it addresses the backreference issue.
What vulnerabilities are associated with CVE-2007-4770?
CVE-2007-4770 may lead to out-of-bounds memory access and possible remote code execution vulnerabilities.
Which software is affected by CVE-2007-4770?
CVE-2007-4770 affects International Components for Unicode (ICU) versions up to 3.8.1.
Who can exploit CVE-2007-4770?
CVE-2007-4770 can be exploited by context-dependent attackers who can manipulate input to trigger the backreference issue.