HIGH
icu: Stack-based buffer overflow by canonicalizing the given localeID
Published Jun 21, 2012
7.5
HIGHCVSS 2.0
EPSS 8.00%
Description
Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
Affected products
No data.
- < 49.1
No data.
Red Hat Enterprise Linux 5
icu-0:3.6-5.16.1
Fixed · RHSA-2011:1815
Red Hat Enterprise Linux 6
icu-0:4.2.1-9.1.el6_2
Fixed · RHSA-2011:1815
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | icu-0:3.6-5.16.1 | Fixed | RHSA-2011:1815 |
| Red Hat Enterprise Linux 6 | icu-0:4.2.1-9.1.el6_2 | Fixed | RHSA-2011:1815 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
7.5 HIGH NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
8.00% 0.08003
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.08003
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (20 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 8.00% (0.08003) | 94.59th | v5 (v2026.06.15) |
| Jun 15, 2026 | 8.07% (0.08068) | 94.04th | v5 (v2026.06.15) |
| May 13, 2026 | 24.11% (0.24107) | 96.12th | v4 (v2025.03.14) |
| Jan 14, 2026 | 36.39% (0.36386) | 96.98th | v4 (v2025.03.14) |
| Dec 28, 2025 | 34.16% (0.34161) | 96.82th | v4 (v2025.03.14) |
| Nov 26, 2025 | 19.74% (0.19742) | 95.21th | v4 (v2025.03.14) |
| Mar 30, 2025 | 6.09% (0.06090) | 89.83th | v4 (v2025.03.14) |
| Mar 29, 2025 | 13.53% (0.13534) | 90.35th | v4 (v2025.03.14) |
| Mar 17, 2025 | 5.86% (0.05857) | 89.87th | v4 (v2025.03.14) |
| Feb 9, 2025 | 34.98% (0.34975) | 97.19th | v3 (v2023.03.01) |
| Dec 20, 2024 | 31.67% (0.31670) | 97.01th | v3 (v2023.03.01) |
| Dec 17, 2024 | 29.00% (0.28996) | 96.88th | v3 (v2023.03.01) |
| Sep 3, 2024 | 25.30% (0.25304) | 96.77th | v3 (v2023.03.01) |
| May 17, 2024 | 22.43% (0.22427) | 96.48th | v3 (v2023.03.01) |
| Mar 7, 2023 | 21.90% (0.21899) | 95.67th | v3 (v2023.03.01) |
| Mar 6, 2023 | 12.25% (0.12248) | 95.30th | v2 (v2022.01.01) |
| Feb 13, 2023 | 12.25% (0.12248) | 95.13th | v2 (v2022.01.01) |
| Feb 3, 2023 | 2.69% (0.02686) | 82.44th | v2 (v2022.01.01) |
| Apr 1, 2022 | 12.25% (0.12248) | 94.93th | v2 (v2022.01.01) |
| Feb 4, 2022 | 12.25% (0.12248) | 89.34th | v2 (v2022.01.01) |
Weaknesses (2)
References (25)
- http://bugs.icu-project.org/trac/ticket/8984 x_refsource_CONFIRMIssue TrackingVendor Advisory
- http://code.google.com/p/chromium/issues/detail?id=106441 x_refsource_CONFIRMThird Party Advisory
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html vendor-advisoryx_refsource_SUSEThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2011-1815.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://secunia.com/advisories/47146 third-party-advisoryx_refsource_SECUNIAPermissions Required
- http://secunia.com/advisories/47227 third-party-advisoryx_refsource_SECUNIAPermissions Required
- http://secunia.com/advisories/47674 third-party-advisoryx_refsource_SECUNIAPermissions Required
- http://secunia.com/advisories/47714 third-party-advisoryx_refsource_SECUNIAPermissions Required
- http://secunia.com/advisories/47775 third-party-advisoryx_refsource_SECUNIAPermissions Required
- http://support.apple.com/kb/HT5501 x_refsource_CONFIRMThird Party Advisory
- http://support.apple.com/kb/HT5503 x_refsource_CONFIRMThird Party Advisory
- http://ubuntu.com/usn/usn-1348-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.debian.org/security/2012/dsa-2397 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:194 vendor-advisoryx_refsource_MANDRIVAThird Party Advisory
- http://www.openwall.com/lists/oss-security/2011/12/09/2 mailing-listx_refsource_MLISTMailing List
- http://www.openwall.com/lists/oss-security/2011/12/09/5 mailing-listx_refsource_MLISTMailing List
- http://www.osvdb.org/77698 vdb-entryx_refsource_OSVDBBroken Link
- http://www.securityfocus.com/bid/51006 vdb-entryx_refsource_BIDPatchThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2011-4599 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=765812 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71726 vdb-entryx_refsource_XFVDB Entry
- https://nvd.nist.gov/vuln/detail/CVE-2011-4599
- https://www.cve.org/CVERecord?id=CVE-2011-4599
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jun 21, 2012
Updated Aug 7, 2024
Reserved Nov 29, 2011
Link CVE-2011-4599
CISA Vulnrichment
Updated n/a