CVE-2014-9654
Fixed in a distro release EPSS 2%
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.
Products: google chrome, icu-project international_components_for_unicode
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | icu | 52.1-7.1 |
| Debian 13 | icu | 52.1-7.1 |
| Debian 14 | icu | 52.1-7.1 |
| Debian 6.0 | icu | 4.4.1-8+squeeze3 |
| Debian 7 | icu | 4.8.1.1-12+deb7u2 |
| Red Hat rhel extras 6 | chromium-browser | 0:40.0.2214.91-1.el6_6 |
| Red Hat rhel extras 6 | chromium-browser-debuginfo | 0:40.0.2214.91-1.el6_6 |
| SUSE Linux Enterprise Desktop 11 SP4 | icu | 4.0-7.30.2 |
| SUSE Linux Enterprise Desktop 12 | icu | 52.1-7.1 |
| SUSE Linux Enterprise Server 11 SP4 | icu | 4.0-38.1 |
| SUSE Linux Enterprise Server 11 SP4 | icu | 4.0-7.30.2 |
| SUSE Linux Enterprise Server 12 | icu | 52.1-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | icu | 4.0-7.30.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | icu | 4.0-38.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | icu | 52.1-7.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | icu | 4.0-7.30.2 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | icu | 4.0-38.1 |
| SUSE Linux Enterprise Software Development Kit 12 | icu | 52.1-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 | icu | 52.1-7.1 |
| Ubuntu 14.04 LTS | icu | 52.1-3ubuntu0.2 |