CVE-2014-7940 The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not initialize memory for....
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted character sequence.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icu(Debian:12) | < 52.1-7.1 | 52.1-7.1 |
| debian/icu(Debian:13) | < 52.1-7.1 | 52.1-7.1 |
| debian/icu(Debian:14) | < 52.1-7.1 | 52.1-7.1 |
| Google Chrome | <= 40.0.2214.85 | No fix listed |
| icu-project international components for unicode | <= 52.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-7940 vendor-advisory
- advisories.mageia.org
- googlechromereleases.blogspot.com
- openSUSE-SU-2015:0441 vendor-advisory
- RHSA-2015:0093 vendor-advisory
- 62383 third-party-advisory
- 62575 third-party-advisory
- 62665 third-party-advisory
- GLSA-201502-13 vendor-advisory
- www.oracle.com
- www.oracle.com
- 72288 vdb-entry
- 1031623 vdb-entry
- USN-2476-1 vendor-advisory
- chromium.googlesource.com
- chromium.googlesource.com
- code.google.com
- GLSA-201503-06 vendor-advisory
- www.oracle.com
- bugs.debian.org issue-tracking