PT-2017-3720 · Google+6 · Google Chrome+6

Published 2017-12-06 · Updated 2024-06-15 · CVE-2017-15422

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: International Components for Unicode (ICU) for C/C++ versions prior to 60.1 Google Chrome versions prior to 63.0.3239.84

Description: The issue is related to an integer overflow in international date handling, which can be exploited by a remote attacker using a crafted HTML page. This can lead to an out of bounds memory read. The vulnerability may also allow an attacker to cause a denial of service or execute arbitrary code.

Recommendations: For International Components for Unicode (ICU) for C/C++ versions prior to 60.1, update to version 60.1 or later. For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-254

CWE-190

Related Identifiers

ALT-PU-2017-2813

BDU:2018-01485

CVE-2017-15422

DSA-4150-1

MGASA-2017-0484

OPENSUSE-SU-2017:3245-1

OPENSUSE-SU-2017_3244-1

OPENSUSE-SU-2018_1422-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:3401

RHSA-2017_3401

SUSE-SU-2018:1401-1

SUSE-SU-2018:1401-2

SUSE-SU-2018:1602-1

USN-3610-1

Affected Products

Alt Linux

Google Chrome

International Components For Unicode (Icu) For C/C++

Opera

Red Hat

Suse

Ubuntu

References · 2459

• 🔥 https://github.com/xuechiyaobai/V8_November_2017/tree/master/CVE-2017-15428 · Exploit
• 🔥 https://crbug.com/774382 · Exploit
• https://osv.dev/vulnerability/USN-3610-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15422 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1401-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1401-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0484 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01485 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-15422 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15419 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15411 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15408 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15422 · Security Note
• https://bdu.fstec.ru/vul/2016-01661 · Security Note
• https://debian.org/security/2018/dsa-4150 · Vendor Advisory