A stack buffer overflow was found in ICU version 76.0.1. While running the genrb binary the 'subtag' struct is overflowed in SRBRoot::addTag function. This may lead to memory corruption and arbitrary code execution.

A stack buffer overflow was found in ICU version 76.0.1. While running the genrb binary the 'subtag' struct is overflowed in SRBRoot::addTag function. This may lead to memory corruption and arbitrary code execution.

André Bargull discovered that ICU incorrectly handled certain strings. An attacker could possibly use this issue to execute arbitrary code.

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1036 to the following vulnerability:

International Components for Unicode (ICU) in Apple Mac OS X before 10.5.3 omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

References:

http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Proposed patch (icu part):

http://bugs.icu-project.org/trac/search?q=%22ticket:6175:%22&noquickjump=1&changeset=on

Proposed patch (icu4j part):

http://bugs.icu-project.org/trac/search?q=%22ticket:6198:%22&noquickjump=1&changeset=on

It was discovered that ICU incorrectly handled certain calendars. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash, leading to a denial of service.