CVE-2016-6293: Buffer Overflow
The ulocacceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6293?
CVE-2016-6293 has been classified as a high severity vulnerability due to its potential to result in denial of service.
How do I fix CVE-2016-6293?
To fix CVE-2016-6293, update the International Components for Unicode (ICU) library to version 57.2 or later.
What type of attack does CVE-2016-6293 facilitate?
CVE-2016-6293 facilitates out-of-bounds read attacks, which can lead to denial of service.
Which versions of ICU are affected by CVE-2016-6293?
CVE-2016-6293 affects ICU versions prior to 57.2, including version 57.1.
Is CVE-2016-6293 specific to any programming language?
CVE-2016-6293 is specific to C/C++ implementations of the ICU library.