> IBM ICU 输入验证错误漏洞

IBM ICU 输入验证错误漏洞

CNNVD-ID编号	CNNVD-202003-786	CVE编号	CVE-2020-10531
发布时间	2020-03-12	更新时间	2021-01-21
漏洞类型	输入验证错误	漏洞来源	N/A
危险等级	高危	威胁类型	远程
厂商	N/A

漏洞介绍

IBM International Components for Unicode（ICU）是美国IBM公司的一个为C/C++和Java编程语言提供了一整套操作Unicode数据的函数库，也是一个用于支持软件国际化的开源项目。

IBM ICU 66.1及之前版本中的common/unistr.cpp文件的‘UnicodeString：：doAppend()’函数存在输入验证错误漏洞。攻击者可利用该漏洞执行任意代码，或者导致应用程序崩溃。

漏洞补丁

目前厂商已发布升级了IBM ICU 输入验证错误漏洞的补丁，IBM ICU 输入验证错误漏洞的补丁获取链接：

https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca

参考网址

来源:UBUNTU

链接：https://usn.ubuntu.com/4305-1/

来源:GENTOO

链接：https://security.gentoo.org/glsa/202003-15

来源:MISC

链接：https://unicode-org.atlassian.net/browse/ICU-20958

来源:REDHAT

链接：https://access.redhat.com/errata/RHSA-2020:0738

来源:MISC

链接：https://bugs.chromium.org/p/chromium/issues/detail?id=1044570

来源:MISC

链接：https://www.oracle.com/security-alerts/cpujan2021.html

来源:MISC

链接：https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08

来源:MISC

链接：https://github.com/unicode-org/icu/pull/971

来源:MISC

链接：https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html

来源:MISC

链接：https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca

来源:FEDORA

链接：https://lists.fedoraproject.org/archives/list/[email protected]/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/

来源:FEDORA

链接：https://lists.fedoraproject.org/archives/list/[email protected]/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/

来源:MLIST

链接：https://lists.debian.org/debian-lts-announce/2020/03/msg00024.html

来源:SUSE

链接：http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html

来源:DEBIAN

链接：https://www.debian.org/security/2020/dsa-4646

来源:FEDORA

链接：https://lists.fedoraproject.org/archives/list/[email protected]/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

来源:www.nsfocus.net

链接：http://www.nsfocus.net/vulndb/47950

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vulnerable-to-multiple-node-js-vulnerabilities-cve-2020-11080-cve-2020-10531-cve-2020-8172-cve-2020-8174/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-identity-manager-is-affected-by-security-vulnerabilities-8/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1217/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-with-node-js/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.2372/

来源:nvd.nist.gov

链接：https://nvd.nist.gov/vuln/detail/CVE-2020-10531

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-certified-container-is-affected-by-multiple-node-js-vulnerabilities/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/158507/Red-Hat-Security-Advisory-2020-3084-01.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1192/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1639/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/158398/Red-Hat-Security-Advisory-2020-2895-01.html

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-cloud-native-event-analytics-is-affected-by-a-international-components-for-unicode-icu-for-c-c-vulnerability-cve-2020-10531/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-js-affect-ibm-spectrum-protect-plus-cve-2020-10531-cve-2020-8172-cve-2020-8174-cve-2020-11080/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/157228/Red-Hat-Security-Advisory-2020-1475-01.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.3700/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1349/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-icu-cve-2020-10531-2/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-version-10-19-0-of-node-js-included-in-ibm-netcool-operations-insight-1-6-0-x-has-several-security-vulnerabilities/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/157135/Red-Hat-Security-Advisory-2020-1343-01.html

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/159095/Red-Hat-Security-Advisory-2020-3578-01.html

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-in-node-js-affect-ibm-app-connect-enterprise-v11/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.3081/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/157064/Red-Hat-Security-Advisory-2020-1293-01.html

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/157087/Red-Hat-Security-Advisory-2020-1317-01.html

受影响实体

暂无

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-786