PT-2015-3267 · Icu+5 · International Components For Unicode+5

Published 2015-01-21 · Updated 2024-06-15 · CVE-2014-7940

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) versions 52 through SVN revision 293126 Google Chrome versions prior to 40.0.2214.91

Description The issue is related to the collator implementation in the International Components for Unicode (ICU) library, which does not properly initialize memory for a data structure. This can be exploited by remote attackers using a crafted character sequence, potentially leading to a denial of service or other unspecified impacts.

Recommendations For International Components for Unicode (ICU) versions 52 through SVN revision 293126, update to a version after SVN revision 293126 to resolve the issue. For Google Chrome versions prior to 40.0.2214.91, update to version 40.0.2214.91 or later to fix the problem.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2015-1098

BDU:2016-01659

CVE-2014-7940

DLA-219-1

DSA-3187-1

MGASA-2015-0047

OPENSUSE-SU-2015_0441-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

RHSA-2015:0093

RHSA-2015_0093

USN-2476-1

USN-2522-1

Affected Products

Alt Linux

Google Chrome

International Components For Unicode

Red Hat

Suse

Ubuntu

References · 2521

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2014-7927.md · Exploit
• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2014-7928.md · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7929 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7934 · Security Note
• https://ubuntu.com/security/CVE-2014-7924 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7946 · Security Note
• https://bdu.fstec.ru/vul/2015-09975 · Security Note
• https://ubuntu.com/security/CVE-2014-7926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7940 · Security Note
• https://osv.dev/vulnerability/USN-2522-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0047.html · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1098 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7943 · Security Note
• https://ubuntu.com/security/CVE-2014-7928 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-7925 · Vendor Advisory