CVE-2016-6293

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) versions prior to 57.1

Description The issue is related to the uloc acceptLanguageFromHTTP function in common/uloc.cpp, which does not ensure that there is a 0 character at the end of a certain temporary array. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.

Recommendations For versions prior to 57.1, update to version 57.1 or later to resolve the issue. As a temporary workaround, consider restricting the length of the httpAcceptLanguage argument to prevent out-of-bounds reads.