Published: 23/07/2015 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome prior to 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote malicious users to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
google chrome
redhat enterprise linux server supplementary eus 6.7z
redhat enterprise linux desktop supplementary 6.0
redhat enterprise linux server supplementary 6.0
redhat enterprise linux workstation supplementary 6.0
opensuse opensuse 13.1
opensuse opensuse 13.2
debian debian linux 8.0
oracle solaris 11.3

Debian Bug report logs - #798647 icu: CVE-2015-1270 Package: src:icu; Maintainer for src:icu is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 11 Sep 2015 12:45:01 UTC Severity: important Tags: fixed-upstream, patch, security, upstream Found in versions ic ...

Several security issues were fixed in Oxide ...

Several security issues were fixed in ICU ...

It was discovered that the International Components for Unicode (ICU) library mishandles converter names starting with x-, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file For the stable distribution (jessie), this problem has been fixed in versio ...

The ucnv_io_getConverterName function in common/ucnv_iocpp in International Components for Unicode (ICU), as used in Google Chrome before 440240389, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a craf ...

CWE-19 https://codereview.chromium.org/1157143002/http://rhn.redhat.com/errata/RHSA-2015-1499.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html http://www.securitytracker.com/id/1033031 https://code.google.com/p/chromium/issues/detail?id=444573 http://www.debian.org/security/2015/dsa-3360 http://www.ubuntu.com/usn/USN-2740-1 https://security.gentoo.org/glsa/201603-09 http://www.securityfocus.com/bid/75973 http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html https://chromium.googlesource.com/chromium/deps/icu/+/f1ad7f9ba957571dc692ea3e187612c685615e19 http://www.debian.org/security/2015/dsa-3315 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798647 https://nvd.nist.gov https://usn.ubuntu.com/2677-1/https://access.redhat.com/security/cve/cve-2015-1270

CVE-2015-1270

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect