CVE-2016-7594
HighSummary
An issue was discovered in certain Apple products, including iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, related to the 'ICU' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
Risk Assessment
Organizations may be exposed to remote attacks that could lead to unauthorized access to systems or application crashes, resulting in data loss and downtime.
Recommendation
It is recommended to update all affected Apple products to the latest versions to minimize the risk associated with this vulnerability.
Other vulnerabilities in ICU
See all- CVE-2025-5222High
A stack buffer overflow was found in the International Components for Unicode (ICU) library when running the genrb binary. The vulnerability occurs in the SRBRoot::addTag function, where the 'subtag' struct overflows, potentially leading to memory corruption and local arbitrary code execution.
- CVE-2020-21913Medium
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
- CVE-2020-10531High
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
- CVE-2017-15422Medium
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "ICU" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS