CVE-2014-9654
CriticalSummary
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before version 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field. This allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string.
Risk Assessment
Organizations may be exposed to remote attacks leading to denial of service, which can affect the availability of applications and systems. Additionally, there is a risk of unspecified impact on data security.
Recommendation
It is recommended to update to the latest version of Google Chrome and monitor the use of the ICU package in C/C++ applications. A security audit should also be conducted to identify potential threats.
Original NVD description (English source)
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.