CVE-2017-15422
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Risk Assessment
An attacker can exploit this vulnerability to read data from process memory, potentially leading to disclosure of sensitive information or destabilization of the browser.
Recommendation
Update Google Chrome to version 63.0.3239.84 or later and update ICU to version 60.1 or later in other products.
Other vulnerabilities in ICU
See all- CVE-2016-7594High
An issue was discovered in certain Apple products, including iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, related to the 'ICU' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2025-5222High
A stack buffer overflow was found in the International Components for Unicode (ICU) library when running the genrb binary. The vulnerability occurs in the SRBRoot::addTag function, where the 'subtag' struct overflows, potentially leading to memory corruption and local arbitrary code execution.
- CVE-2020-21913Medium
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
- CVE-2020-10531High
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
Original NVD description (English source)
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS