Unscored severity · published Jan 29, 2008
CVE-2007-4770
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow…
–
CVSS
2.9%
EPSS
No
On KEV
Description
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
International Components For Unicode · Icu-project
through 3.8.1 · source: NVD
Affected product
IC
International Components For Unicode
Icu-project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4770
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4770
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2008-0090.html
Permissions Required
http://secunia.com/advisories/28575
Permissions Required
http://secunia.com/advisories/28615
Permissions Required
http://secunia.com/advisories/28669
Permissions Required
http://secunia.com/advisories/28783
More from International Components For Unicode
9.8
CVE-2018-18928
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp
9.8
CVE-2017-17484
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion,…
9.8
CVE-2017-14952
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a…
9.8
CVE-2014-9654
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values…
9.8
CVE-2014-9911
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote…