Vulnerability-Lookup

ubuntu-cve-2014-9911

Vulnerability from osv_ubuntu

Published

2017-01-04 00:00

Modified

2026-04-22 07:37

Summary

Details

Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2014-9911	REPORT
	http://bugs.icu-project.org/trac/ticket/10891	REPORT
	http://www.openwall.com/lists/oss-security/2016/11/25/1	REPORT
	https://ubuntu.com/security/notices/USN-3227-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2014-9911	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icu-devtools",
            "binary_version": "52.1-3ubuntu0.5"
          },
          {
            "binary_name": "libicu52",
            "binary_version": "52.1-3ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "icu",
        "purl": "pkg:deb/ubuntu/icu@52.1-3ubuntu0.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "52.1-3ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.8.1.1-12ubuntu2",
        "4.8.1.1-13+nmu1",
        "4.8.1.1-13+nmu1ubuntu1",
        "52.1-3",
        "52.1-3ubuntu0.2",
        "52.1-3ubuntu0.3",
        "52.1-3ubuntu0.4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "android",
            "binary_version": "20160330-0939-0ubuntu1"
          },
          {
            "binary_name": "android-copyright",
            "binary_version": "20160330-0939-0ubuntu1"
          },
          {
            "binary_name": "android-emulator",
            "binary_version": "20160330-0939-0ubuntu1"
          },
          {
            "binary_name": "ubuntu-emulator-images",
            "binary_version": "20160330-0939-0ubuntu1"
          },
          {
            "binary_name": "ubuntu-emulator-runtime",
            "binary_version": "20160330-0939-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "android",
        "purl": "pkg:deb/ubuntu/android@20160330-0939-0ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "20150818-1500-0ubuntu2",
        "20150818-1500-0ubuntu3",
        "20160307-0742-0ubuntu3",
        "20160330-0939-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-24-0v5",
            "binary_version": "24.2.0-3ubuntu2.1"
          },
          {
            "binary_name": "libmozjs-24-bin",
            "binary_version": "24.2.0-3ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "mozjs24",
        "purl": "pkg:deb/ubuntu/mozjs24@24.2.0-3ubuntu2.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.2.0-3ubuntu1",
        "24.2.0-3ubuntu2",
        "24.2.0-3ubuntu2.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.",
  "id": "UBUNTU-CVE-2014-9911",
  "modified": "2026-04-22T07:37:45Z",
  "published": "2017-01-04T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9911"
    },
    {
      "type": "REPORT",
      "url": "http://bugs.icu-project.org/trac/ticket/10891"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/25/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3227-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-9911"
    }
  ],
  "related": [
    "USN-3227-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2014-9911"
  ]
}

CVE-2014-9911 (GCVE-0-2014-9911)

Vulnerability from cvelistv5 – Published: 2017-01-04 20:00 – Updated: 2024-08-06 14:02

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

8 references

URL	Tags
http://bugs.icu-project.org/trac/changeset/35699	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1383569	x_refsource_CONFIRM
http://www.securitytracker.com/id/1037556	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/94520	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/25/1	mailing-listx_refsource_MLIST
https://bugs.php.net/bug.php?id=67397	x_refsource_CONFIRM
http://bugs.icu-project.org/trac/ticket/1089	x_refsource_CONFIRM
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC

Date Public

2014-06-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:02:37.743Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.icu-project.org/trac/changeset/35699"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1383569"
          },
          {
            "name": "1037556",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037556"
          },
          {
            "name": "94520",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94520"
          },
          {
            "name": "[oss-security] 20161124 Re: CVE request: icu: stack-based buffer overflow in uloc_getDisplayName",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/11/25/1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=67397"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.icu-project.org/trac/ticket/1089"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-06-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-23T19:08:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.icu-project.org/trac/changeset/35699"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1383569"
        },
        {
          "name": "1037556",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037556"
        },
        {
          "name": "94520",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94520"
        },
        {
          "name": "[oss-security] 20161124 Re: CVE request: icu: stack-based buffer overflow in uloc_getDisplayName",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/11/25/1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=67397"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.icu-project.org/trac/ticket/1089"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9911",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugs.icu-project.org/trac/changeset/35699",
              "refsource": "CONFIRM",
              "url": "http://bugs.icu-project.org/trac/changeset/35699"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1383569",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1383569"
            },
            {
              "name": "1037556",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037556"
            },
            {
              "name": "94520",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94520"
            },
            {
              "name": "[oss-security] 20161124 Re: CVE request: icu: stack-based buffer overflow in uloc_getDisplayName",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/11/25/1"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=67397",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=67397"
            },
            {
              "name": "http://bugs.icu-project.org/trac/ticket/1089",
              "refsource": "CONFIRM",
              "url": "http://bugs.icu-project.org/trac/ticket/1089"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9911",
    "datePublished": "2017-01-04T20:00:00.000Z",
    "dateReserved": "2016-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-06T14:02:37.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-3227-1

Vulnerability from osv_ubuntu

Published

2017-03-13 16:42

Modified

2026-04-22 07:36

Summary

icu vulnerabilities

Details

It was discovered that ICU incorrectly handled certain memory operations when processing data. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.

References

URL

Type

	https://ubuntu.com/security/notices/USN-3227-1	ADVISORY
	https://ubuntu.com/security/CVE-2014-9911	REPORT
	https://ubuntu.com/security/CVE-2015-4844	REPORT
	https://ubuntu.com/security/CVE-2016-0494	REPORT
	https://ubuntu.com/security/CVE-2016-6293	REPORT
	https://ubuntu.com/security/CVE-2016-7415	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-9911",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-4844",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-0494",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-6293",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-7415",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icu-devtools",
            "binary_version": "52.1-3ubuntu0.5"
          },
          {
            "binary_name": "libicu52",
            "binary_version": "52.1-3ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "icu",
        "purl": "pkg:deb/ubuntu/icu@52.1-3ubuntu0.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "52.1-3ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.8.1.1-12ubuntu2",
        "4.8.1.1-13+nmu1",
        "4.8.1.1-13+nmu1ubuntu1",
        "52.1-3",
        "52.1-3ubuntu0.2",
        "52.1-3ubuntu0.3",
        "52.1-3ubuntu0.4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-4844",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-0494",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-6293",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-7415",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icu-devtools",
            "binary_version": "55.1-7ubuntu0.1"
          },
          {
            "binary_name": "libicu55",
            "binary_version": "55.1-7ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "icu",
        "purl": "pkg:deb/ubuntu/icu@55.1-7ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "55.1-7ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "55.1-4ubuntu1",
        "55.1-6ubuntu1",
        "55.1-7"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that ICU incorrectly handled certain memory operations\nwhen processing data. If an application using ICU processed crafted data,\na remote attacker could possibly cause it to crash or potentially execute\narbitrary code with the privileges of the user invoking the program.\n",
  "id": "USN-3227-1",
  "modified": "2026-04-22T07:36:34Z",
  "published": "2017-03-13T16:42:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3227-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9911"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-4844"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-0494"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-6293"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7415"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "icu vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2014-9911",
    "UBUNTU-CVE-2015-4844",
    "UBUNTU-CVE-2016-0494",
    "UBUNTU-CVE-2016-6293",
    "UBUNTU-CVE-2016-7415"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2014-9911

Vulnerability from osv_ubuntu

CVE-2014-9911 (GCVE-0-2014-9911)

usn-3227-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature