Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-15396: Chrome and Linux ICU overflow lets attackers run code

CVE-2017-15396 · published 8 years ago

Summary

Versions of Google Chrome before 62.0.3202.75 and certain older Linux distributions that include the ICU library can be tricked by a specially crafted web page to corrupt memory. This could allow an attacker to run unauthorized code on the affected computer. Update Chrome and the operating system’s ICU packages to the latest releases to protect against this risk.

What to do

Update google chrome to version 62.0.3202.75 or later.
Update icu-project international_components_for_unicode to version 60.2 or later.

Affected software

Vendor	Product	Affected versions
google	chrome	< 62.0.3202.75 `cpe:2.3:a:google:chrome::::::::`
redhat	enterprise_linux_desktop	6.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0 `cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_workstation	6.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`
debian	debian_linux	8.0 9.0 10.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
icu-project	international_components_for_unicode	< 60.2 `cpe:2.3:a:icu-project:international_components_for_unicode::::::c\/c\+\+::*`

Original advisory text

A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a re...

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published28 Aug 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-15396 · NVD

Track software like this

Free during beta