CVE-2014-9654 The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that...
CriticalCVSS 9.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icu(Debian:12) | < 52.1-7.1 | 52.1-7.1 |
| debian/icu(Debian:13) | < 52.1-7.1 | 52.1-7.1 |
| debian/icu(Debian:14) | < 52.1-7.1 | 52.1-7.1 |
| Google Chrome | <= 40.0.2214.85 | No fix listed |
| icu-project international components for unicode | < 55.1 | 55.1 |
References
- Debian Security Tracker CVE-2014-9654 vendor-advisory
- bugs.icu-project.org issue-tracking
- bugs.icu-project.org issue-tracking vendor-advisory
- [oss-security] 20150205 Re: CVE request - ICU mailing-list third-party-advisory
- www.oracle.com
- 1035410 third-party-advisory vdb-entry
- chromium.googlesource.com issue-tracking third-party-advisory
- code.google.com issue-tracking third-party-advisory
- GLSA-201503-06 third-party-advisory vendor-advisory
- www.oracle.com
- bugs.debian.org issue-tracking