CVE-2017-17484

The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.

• CWE-119

• https://github.com/znc/znc/issues/1459Issue Tracking, Third Party Advisory
• https://ssl.icu-project.org/trac/attachment/ticket/13490/poc.cppExploit, Vendor Advisory
• https://ssl.icu-project.org/trac/changeset/40714Issue Tracking, Patch, Vendor Advisory
• https://ssl.icu-project.org/trac/changeset/40715Issue Tracking, Vendor Advisory
• https://ssl.icu-project.org/trac/ticket/13490Issue Tracking, Vendor Advisory
• https://ssl.icu-project.org/trac/ticket/13510Issue Tracking, Vendor Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://github.com/znc/znc/issues/1459Issue Tracking, Third Party Advisory
• https://ssl.icu-project.org/trac/attachment/ticket/13490/poc.cppExploit, Vendor Advisory
• https://ssl.icu-project.org/trac/changeset/40714Issue Tracking, Patch, Vendor Advisory
• https://ssl.icu-project.org/trac/changeset/40715Issue Tracking, Vendor Advisory
• https://ssl.icu-project.org/trac/ticket/13490Issue Tracking, Vendor Advisory
• https://ssl.icu-project.org/trac/ticket/13510Issue Tracking, Vendor Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Published

Dec 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17477Pexip Infinity before 17 allows an unauthenticated remote at…6.1
• CVE-2017-17478An XSS issue was discovered in Designer Studio in Pegasystem…
• CVE-2017-17479In OpenJPEG 2.3.0, a stack-based buffer overflow was discove…
• CVE-2017-1748IBM Connections 5.0, 5.5, and 6.0 could allow a remote attac…6.8
• CVE-2017-17480In OpenJPEG 2.3.0, a stack-based buffer overflow was discove…9.8
• CVE-2017-17482An issue was discovered in OpenVMS through V8.4-2L2 on Alpha…
• CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through …9.8
• CVE-2017-1749IBM UrbanCode Deploy 6.1 through 6.9.6.0 could allow a remot…5.3
• CVE-2017-17496Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-17497In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.…7.5
• CVE-2017-17498WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allow…
• CVE-2017-17499ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a us…9.8