Back to CVE records
High 8.8Published Mar 12, 2020
CVE-2020-10531An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1.
Updated under an hour ago ()
Does this affect you?
It affects Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and 13 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
- CVSS
- 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
icu-project international_components_for_unicode icu-project:international_components_for_unicode | through 66.1 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 6.0 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 6.0 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 6.0 | NVD |
google chrome google:chrome | before 80.0.3987.122 | NVD |
fedoraproject fedora fedoraproject:fedora | 30; 31; 33 | NVD |
debian debian_linux debian:debian_linux | 8.0; 9.0; 10.0 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 12.04; 14.04; 16.04; 18.04; 19.10 | NVD |
opensuse leap opensuse:leap | 15.1 | NVD |
oracle banking_extensibility_workbench oracle:banking_extensibility_workbench | 14.3.0; 14.4.0 | NVD |
nodejs node.js nodejs:node.js | from 10.0.0 through 10.12.0; from 10.13.0 before 10.21.0 | NVD |
References
- https://access.redhat.com/errata/RHSA-2020:0738vendor-advisory, x-refsource-redhat, third-party-advisory
- https://security.gentoo.org/glsa/202003-15vendor-advisory, x-refsource-gentoo, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/vendor-advisory, x-refsource-fedora
- https://lists.debian.org/debian-lts-announce/2020/03/msg00024.htmlmailing-list, x-refsource-mlist, third-party-advisory
- https://www.debian.org/security/2020/dsa-4646vendor-advisory, x-refsource-debian, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/vendor-advisory, x-refsource-fedora
- https://usn.ubuntu.com/4305-1/vendor-advisory, x-refsource-ubuntu, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/vendor-advisory, x-refsource-fedora
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc, patch, third-party-advisory
- https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.htmlx-refsource-misc, third-party-advisory
- https://bugs.chromium.org/p/chromium/issues/detail?id=1044570x-refsource-misc, permissions-required, third-party-advisory
- https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08x-refsource-misc, patch, third-party-advisory
- https://unicode-org.atlassian.net/browse/ICU-20958x-refsource-misc, permissions-required, third-party-advisory
- https://github.com/unicode-org/icu/pull/971x-refsource-misc, issue-tracking, patch, third-party-advisory
- https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afcax-refsource-misc, patch, third-party-advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlx-refsource-misc, not-applicable, third-party-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc, third-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.