Vulnerability · Published Mar 12, 2020 · Assigned by mitre

CVE-2020-10531

High 8.8

In plain English

A high-severity security flaw in the icu package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)2.7%top 14.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	icu	60.3-2.el8_1	ALSA-2020:0902
AlmaLinux:8	libicu	60.3-2.el8_1	ALSA-2020:0902
AlmaLinux:8	libicu-devel	60.3-2.el8_1	ALSA-2020:0902
AlmaLinux:8	libicu-doc	60.3-2.el8_1	ALSA-2020:0902
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2020:1293
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2020:1293
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2020:1317
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2020:1317
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2020:1317
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2020:1293
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2020:1293
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2020:1293
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2020:1317
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2020:1317
Alpine:v3.20	icu	65.1-r1	ALPINE-CVE-2020-10531
Alpine:v3.21	icu	65.1-r1	ALPINE-CVE-2020-10531
Alpine:v3.22	icu	65.1-r1	ALPINE-CVE-2020-10531
Alpine:v3.23	icu	65.1-r1	ALPINE-CVE-2020-10531
Alpine:v3.24	icu	65.1-r1	ALPINE-CVE-2020-10531
Debian:12	icu	63.2-3	DEBIAN-CVE-2020-10531
Debian:13	icu	63.2-3	DEBIAN-CVE-2020-10531
Debian:14	icu	63.2-3	DEBIAN-CVE-2020-10531
Rocky Linux:8	icu	0:60.3-2.el8_1	RLSA-2020:0902
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2020:1317
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2020:1293
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2020:1317
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2020:1293

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

RHSA-2020:0738 vendor-advisory, x_refsource_REDHAT
GLSA-202003-15 vendor-advisory, x_refsource_GENTOO
FEDORA-2020-f6271d7afa vendor-advisory, x_refsource_FEDORA
[debian-lts-announce] 20200320 [SECURITY] [DLA 2151-1] icu security update mailing-list, x_refsource_MLIST
DSA-4646 vendor-advisory, x_refsource_DEBIAN
FEDORA-2020-39e0b8bd14 vendor-advisory, x_refsource_FEDORA
USN-4305-1 vendor-advisory, x_refsource_UBUNTU
openSUSE-SU-2020:0459 vendor-advisory, x_refsource_SUSE
FEDORA-2020-43d5a372fc vendor-advisory, x_refsource_FEDORA
https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html x_refsource_MISC
https://bugs.chromium.org/p/chromium/issues/detail?id=1044570 x_refsource_MISC
https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08 x_refsource_MISC
https://unicode-org.atlassian.net/browse/ICU-20958 x_refsource_MISC
https://github.com/unicode-org/icu/pull/971 x_refsource_MISC
https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
https://cert-portal.siemens.com/productcert/html/ssa-398330.html