crítica
CVE-2016-6293
icu: Out-of-bounds access in uloc_acceptLanguageFromHTTP
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.3CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Ubuntu (media), Red Hat (baja).
Descripción
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 2.0 | icu | 67.1-1.ph2 |
| alpine 3.10 | icu | 57.1-r1 |
| alpine 3.11 | icu | 57.1-r1 |
| alpine 3.12 | icu | 57.1-r1 |
| alpine 3.13 | icu | 57.1-r1 |
| alpine 3.14 | icu | 57.1-r1 |
| alpine 3.15 | icu | 57.1-r1 |
| alpine 3.16 | icu | 57.1-r1 |
| alpine 3.17 | icu | 57.1-r1 |
| alpine 3.18 | icu | 57.1-r1 |
| alpine 3.19 | icu | 57.1-r1 |
| alpine 3.20 | icu | 57.1-r1 |
Mostrar las 40 entradas de 37 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 2.0 | icu | 67.1-1.ph2 |
| alpine 3.10 | icu | 57.1-r1 |
| alpine 3.11 | icu | 57.1-r1 |
| alpine 3.12 | icu | 57.1-r1 |
| alpine 3.13 | icu | 57.1-r1 |
| alpine 3.14 | icu | 57.1-r1 |
| alpine 3.15 | icu | 57.1-r1 |
| alpine 3.16 | icu | 57.1-r1 |
| alpine 3.17 | icu | 57.1-r1 |
| alpine 3.18 | icu | 57.1-r1 |
| alpine 3.19 | icu | 57.1-r1 |
| alpine 3.20 | icu | 57.1-r1 |
| alpine 3.21 | icu | 57.1-r1 |
| alpine 3.22 | icu | 57.1-r1 |
| alpine 3.23 | icu | 57.1-r1 |
| alpine 3.24 | icu | 57.1-r1 |
| alpine 3.4 | icu | 57.1-r1 |
| alpine 3.5 | icu | 57.1-r1 |
| alpine 3.6 | icu | 57.1-r1 |
| alpine 3.7 | icu | 57.1-r1 |
| alpine 3.8 | icu | 57.1-r1 |
| alpine 3.9 | icu | 57.1-r1 |
| alpine edge | icu | 57.1-r1 |
| debian 11 | icu | 57.1-4 |
| debian 12 | icu | 57.1-4 |
| debian 13 | icu | 57.1-4 |
| debian 14 | icu | 57.1-4 |
| debian 7 | icu | 4.8.1.1-12+deb7u5 |
| debian 8 | icu | 52.1-8+deb8u4 |
| echo | icu | 57.1-4 |
| Red Hat | icu | sin corrección indicada |
| Red Hat | libicu | sin corrección indicada |
| Red Hat | libicu-devel | sin corrección indicada |
| Red Hat | libicu-doc | sin corrección indicada |
| root.io debian 12 | rootio-icu | 57.1-4 |
| ubuntu 12.04 | icu | 4.8.1.1-3ubuntu0.7 |
| ubuntu 14.04 | icu | 52.1-3ubuntu0.5 |
| ubuntu 14.04-ESM | icu | 52.1-3ubuntu0.5 |
| ubuntu 16.04 | icu | 55.1-7ubuntu0.1 |
| ubuntu 16.04-ESM | icu | 55.1-7ubuntu0.1 |
Referencias
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
- http://openwall.com/lists/oss-security/2016/07/24/2
- http://www.securityfocus.com/bid/92127
- https://access.redhat.com/security/cve/CVE-2016-6293
- https://bugs.php.net/72533
- https://nvd.nist.gov/vuln/detail/CVE-2016-6293
- https://security.gentoo.org/glsa/201701-58
- https://ubuntu.com/security/notices/USN-3227-1