SB2025080115 - Multiple vulnerabilities in IBM i
Published: August 1, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Double free memory error (CVE-ID: CVE-2017-14952)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to double free memory error in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++. A remote unauthenticated attacker can supply a ca specially crafted string, aka a "redundant UVector entry clean up function call" issue, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
2) Stack-based buffer overflow (CVE-ID: CVE-2011-4599)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the _canonicalize function in common/uloc.c when processing a crafted locale ID that is not properly handled during variant canonicalization. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Stack-based buffer overflow (CVE-ID: CVE-2017-17484)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to stack-based buffer overflow when the ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion. A remote unauthenticated attacker can supply a specially crafted string, as demonstrated by ZNC, trigger memory corruption and cause the service to crash.
Remediation
Install update from vendor's website.