{"schemaVersion":3,"id":"CVE-2011-4599","aliases":["RHSA-2011:1815","DEBIAN-CVE-2011-4599","DSA-2397-1"],"status":"published","duplicateOf":null,"title":null,"description":"Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.","dates":{"published":"2012-06-21T15:00:00.000Z","modified":"2024-08-07T00:09:19.311Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08003,"percentile":0.9471,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.08003},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08003,"percentile":0.9471}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08003,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08003,"percentile":0.9471}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"debian","product":"icu","name":"icu","label":"icu","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/icu","purlType":"deb","versions":[{"text":"< 4.8.1.1-3","noFixRecorded":false,"fixedIn":null},{"text":"< 4.4.1-8","noFixRecorded":false,"fixedIn":null},{"text":"< 3.8.1-3+lenny3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.8.1.1-3 | < 4.4.1-8 | < 3.8.1-3+lenny3","eol":null,"hubHref":null},{"vendor":"icu-project","product":"international_components_for_unicode","name":"international components for unicode","label":"international_components_for_unicode","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 49.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 49.1","eol":null,"hubHref":"/vendor/icu-project/international_components_for_unicode"},{"vendor":"redhat","product":"icu","name":"icu","label":"icu","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/icu","purlType":"rpm","versions":[{"text":"< 0:3.6-5.16.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:4.2.1-9.1.el6_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:3.6-5.16.1 | < 0:4.2.1-9.1.el6_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"icu-debuginfo","name":"icu-debuginfo","label":"icu-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/icu-debuginfo","purlType":"rpm","versions":[{"text":"< 0:3.6-5.16.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:4.2.1-9.1.el6_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:3.6-5.16.1 | < 0:4.2.1-9.1.el6_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"libicu","name":"libicu","label":"libicu","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/libicu","purlType":"rpm","versions":[{"text":"< 0:3.6-5.16.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:4.2.1-9.1.el6_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:3.6-5.16.1 | < 0:4.2.1-9.1.el6_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"libicu-devel","name":"libicu-devel","label":"libicu-devel","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/libicu-devel","purlType":"rpm","versions":[{"text":"< 0:3.6-5.16.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:4.2.1-9.1.el6_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:3.6-5.16.1 | < 0:4.2.1-9.1.el6_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"libicu-doc","name":"libicu-doc","label":"libicu-doc","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/libicu-doc","purlType":"rpm","versions":[{"text":"< 0:3.6-5.16.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:4.2.1-9.1.el6_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:3.6-5.16.1 | < 0:4.2.1-9.1.el6_2","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/51006","label":"www.securityfocus.com/bid/51006","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Patch","Third Party Advisory"]},{"url":"http://secunia.com/advisories/47674","label":"secunia.com/advisories/47674","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://secunia.com/advisories/47146","label":"secunia.com/advisories/47146","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://secunia.com/advisories/47775","label":"secunia.com/advisories/47775","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html","label":"lists.apple.com/archives/security-announce/2012/Sep/msg00003.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List","Third Party Advisory"]},{"url":"http://support.apple.com/kb/HT5503","label":"support.apple.com/kb/HT5503","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71726","label":"exchange.xforce.ibmcloud.com/vulnerabilities/71726","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.openwall.com/lists/oss-security/2011/12/09/5","label":"www.openwall.com/lists/oss-security/2011/12/09/5","hostname":"www.openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://code.google.com/p/chromium/issues/detail?id=106441","label":"code.google.com/p/chromium/issues/detail?id=106441","hostname":"code.google.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.osvdb.org/77698","label":"www.osvdb.org/77698","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://bugs.icu-project.org/trac/ticket/8984","label":"bugs.icu-project.org/trac/ticket/8984","hostname":"bugs.icu-project.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"http://ubuntu.com/usn/usn-1348-1","label":"ubuntu.com/usn/usn-1348-1","hostname":"ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://secunia.com/advisories/47227","label":"secunia.com/advisories/47227","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:194","label":"www.mandriva.com/security/advisories?name=MDVSA-2011:194","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html","label":"lists.opensuse.org/opensuse-updates/2012-01/msg00035.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","label":"lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List","Third Party Advisory"]},{"url":"http://support.apple.com/kb/HT5501","label":"support.apple.com/kb/HT5501","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2011/12/09/2","label":"www.openwall.com/lists/oss-security/2011/12/09/2","hostname":"www.openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1815.html","label":"rhn.redhat.com/errata/RHSA-2011-1815.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.debian.org/security/2012/dsa-2397","label":"www.debian.org/security/2012/dsa-2397","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/47714","label":"secunia.com/advisories/47714","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1815","label":"access.redhat.com/errata/RHSA-2011:1815","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=765812","label":"bugzilla.redhat.com/show_bug.cgi?id=765812","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1815.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1815.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-4599","label":"access.redhat.com/security/cve/CVE-2011-4599","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4599","label":"www.cve.org/CVERecord?id=CVE-2011-4599","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4599","label":"nvd.nist.gov/vuln/detail/CVE-2011-4599","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-4599","label":"security-tracker.debian.org/tracker/CVE-2011-4599","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2012-06-21T15:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T00:09:19.311Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T10:59:15.467Z","stale":false,"partial":false}}