CVE-2020-10531: Buffer Overflow
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
Other sources
International Components for Unicode (ICU) for C/C++ is vulnerable to a heap-based buffer overflow, caused by an integer overflow in UnicodeString::doAppend() function in common/unistr.cpp. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/icuto a version that resolves this vulnerability.Fixed in 66.1-2Fixed in 63.2-3Fixed in 63.1-6+deb10u1Fixed in 57.1-6+deb9u4 - Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 80.0.3987.122 - Upgrade
Upgrade
redhat/nodeto a version that resolves this vulnerability.Fixed in 14.3.0 - Upgrade
Upgrade
redhat/nodeto a version that resolves this vulnerability.Fixed in 12.17.0 - Upgrade
Upgrade
redhat/nodeto a version that resolves this vulnerability.Fixed in 10.21.0 - Upgrade
Upgrade
debian/icuto a version that resolves this vulnerability.Fixed in 72.1-3+deb12u1Fixed in 76.1-4Fixed in 78.3-2
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-10531.
What is the severity of CVE-2020-10531?
The severity of CVE-2020-10531 is critical with a CVSS score of 9.8.
Which software or products are affected by CVE-2020-10531?
The affected software/products include International Components for Unicode (ICU) for C/C++, Chromium browser, Node.js, IBM Data Risk Manager, Google Chrome, Redhat Enterprise Linux, Debian Linux, Ubuntu Linux, Fedora, openSUSE Leap, and Oracle Banking Extensibility Workbench.
How can an attacker exploit CVE-2020-10531?
An attacker can exploit CVE-2020-10531 by sending a specially-crafted request to trigger a heap-based buffer overflow in the affected software, leading to arbitrary code execution.
Is there a fix available for CVE-2020-10531?
Yes, there are patches and updates available for the affected software/packages. Please refer to the vendor's official website or security advisories for the appropriate remediation steps.