{"id":"CVE-2014-9654","aliases":["DEBIAN-CVE-2014-9654","DLA-219-1","DSA-3187-1","EUVD-2014-9464","GHSA-7p8r-35pv-r5w2","RHSA-2015:0093","SUSE-SU-2015:0458-1","SUSE-SU-2015:1144-1","SUSE-SU-2015:1790-1","SUSE-SU-2016:1090-1","UBUNTU-CVE-2014-9654","USN-2522-1"],"status":"published","title":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before...","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02422,"percentile":0.84299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-02-05T00:00:00Z","modified":"2026-10-23T16:02:21Z","fixes":[{"ecosystem":"Debian:12","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"icu","fixed_in":["52.1-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","fixed_in":["4.0-7.30.2","4.0-38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"icu","fixed_in":["4.0-7.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","fixed_in":["4.0-7.30.2","4.0-38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","fixed_in":["4.0-7.30.2","4.0-38.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"icu","fixed_in":["52.1-3ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-8+squeeze3"}]}],"versions":["4.4.1-7","4.4.1-8","4.4.1-8+squeeze1","4.4.1-8+squeeze2"],"bundled":10},{"source":"osv","ecosystem":"Debian:7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1.1-12+deb7u2"}]}],"versions":["4.8.1.1-12","4.8.1.1-12+deb7u1"],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.0.2214.91-1.el6_6"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"chromium-browser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.0.2214.91-1.el6_6"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-7.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-7.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-7.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-7.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-38.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.2"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.1-3ubuntu0.2"}]}],"versions":["4.8.1.1-12ubuntu2","4.8.1.1-13+nmu1","4.8.1.1-13+nmu1ubuntu1","52.1-3"],"bundled":10}],"products":[{"vendor":"google","product":"chrome"},{"vendor":"icu-project","product":"international_components_for_unicode"}],"references":[{"url":"http://bugs.icu-project.org/trac/ticket/11371","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","advisory","report"]},{"url":"https://chromium.googlesource.com/chromium/deps/icu/+/dd727641e190d60e4593bcb3a35c7f51eb4925c5","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://code.google.com/p/chromium/issues/detail?id=432209","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1035410","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201503-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://bugs.icu-project.org/trac/changeset/36801","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://openwall.com/lists/oss-security/2015/02/05/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9654","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7p8r-35pv-r5w2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9654","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0093","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://googlechromereleases.blogspot.com/2015/01/stable-update.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185206","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185230","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0093.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7923","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7923","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7924","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7925","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7926","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7927","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7928","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7929","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7931","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7932","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7935","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7936","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7937","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7937","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7940","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7941","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7941","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7941","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7942","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7942","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7942","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7943","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7943","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7944","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7944","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7945","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7947","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7948","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7948","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9654","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1346","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150458-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/917129","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9654","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151144-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151790-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161090-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/952260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9654","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/05/15","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2522-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-1569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-2383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-2384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-2419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7940","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9654","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2017-04-24T06:12:00Z","modified":"2024-08-06T13:47:41.949Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9464","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2017-04-24T06:12:00Z","modified":"2024-08-06T13:47:41Z","updated_at":"2026-11-03T01:56:48.455518Z"}],"ghsa":[{"id":"GHSA-7p8r-35pv-r5w2","title":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before...","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2022-05-14T01:07:16Z","modified":"2023-02-02T05:03:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:34.49846Z"}],"nvd":[{"id":"CVE-2014-9654","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2017-04-24T06:59:00.307Z","modified":"2026-06-17T00:18:43.643Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:58.701118Z"}],"osv":[{"id":"CVE-2014-9654","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2017-04-24T06:59:00Z","modified":"2026-04-10T03:44:52.758486Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9654","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2017-04-24T06:59:00.307Z","modified":"2026-10-23T16:02:21.777660112Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9654","description":"The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.","status":"published","published":"2015-02-05T00:00:00Z","modified":"2026-04-22T09:56:13.844407Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"DLA-219-1","title":"icu - security update","status":"published","published":"2015-05-14T00:00:00Z","modified":"2026-03-09T01:21:21.033938Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3187-1","title":"icu - security update","status":"published","published":"2015-03-15T00:00:00Z","modified":"2026-03-09T01:20:45.332297Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"RHSA-2015:0093","title":"Red Hat Security Advisory: chromium-browser security update","status":"published","published":"2024-09-13T10:10:52Z","modified":"2026-06-29T10:08:22Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0458-1","title":"Security update for icu","description":"icu was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2014-9654: Insufficient size limit checks in regular expression compiler (bnc#917129).\n  ","status":"published","published":"2015-03-02T16:37:13Z","modified":"2026-02-04T03:06:29.81434Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1144-1","title":"Security update for icu","description":"\nThis update fixes the following security issue in icu:\n\n    * CVE-2014-9654: insufficient size limit checks in regular expression\n      compiler (bsc#917129)\n\nSecurity Issues:\n\n    * CVE-2014-9654\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9654\u003e\n\n","status":"published","published":"2015-06-18T10:47:41Z","modified":"2026-02-04T04:01:37.286868Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1790-1","title":"Security update for icu","description":"icu was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2014-9654: Insufficient size limit checks in regular expression compiler (bsc#917129).\n  ","status":"published","published":"2015-10-15T13:14:48Z","modified":"2026-02-04T04:14:35.178484Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:1090-1","title":"Security update for icu","description":"\nThis update for icu fixes the following issue:\n\nThe previous patch for CVE-2014-9654 was incorrect and lead\nto non-working regular expressions. This update fixes this \nproblem (bsc#952260)\n","status":"published","published":"2016-04-18T10:31:48Z","modified":"2026-02-04T02:31:58.473675Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2522-1","title":"icu vulnerabilities","description":"It was discovered that ICU incorrectly handled memory operations when\nprocessing fonts. If an application using ICU processed crafted data, an\nattacker could cause it to crash or potentially execute arbitrary code with\nthe privileges of the user invoking the program. This issue only affected\nUbuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384,\nCVE-2013-2419)\n\nIt was discovered that ICU incorrectly handled memory operations when\nprocessing fonts. If an application using ICU processed crafted data, an\nattacker could cause it to crash or potentially execute arbitrary code with\nthe privileges of the user invoking the program. (CVE-2014-6585,\nCVE-2014-6591)\n\nIt was discovered that ICU incorrectly handled memory operations when\nprocessing regular expressions. If an application using ICU processed\ncrafted data, an attacker could cause it to crash or potentially execute\narbitrary code with the privileges of the user invoking the program.\n(CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)\n\nIt was discovered that ICU collator implementation incorrectly handled\nmemory operations. If an application using ICU processed crafted data, an\nattacker could cause it to crash or potentially execute arbitrary code with\nthe privileges of the user invoking the program. (CVE-2014-7940)\n","status":"published","published":"2015-03-05T13:31:51Z","modified":"2026-04-22T09:09:24.831886Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}