Vulnerability-Lookup

ubuntu-cve-2014-9654

Vulnerability from osv_ubuntu

Published

2015-02-05 00:00

Modified

2026-04-22 07:37

Summary

Details

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2014-9654	REPORT
	https://chromium.googlesource.com/chromium/deps/i…	REPORT
	http://www.openwall.com/lists/oss-security/2015/0…	REPORT
	https://ubuntu.com/security/notices/USN-2522-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2014-9654	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icu-devtools",
            "binary_version": "52.1-3ubuntu0.2"
          },
          {
            "binary_name": "libicu52",
            "binary_version": "52.1-3ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "icu",
        "purl": "pkg:deb/ubuntu/icu@52.1-3ubuntu0.2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "52.1-3ubuntu0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.8.1.1-12ubuntu2",
        "4.8.1.1-13+nmu1",
        "4.8.1.1-13+nmu1ubuntu1",
        "52.1-3"
      ]
    }
  ],
  "aliases": [],
  "details": "The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.",
  "id": "UBUNTU-CVE-2014-9654",
  "modified": "2026-04-22T07:37:44Z",
  "published": "2015-02-05T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9654"
    },
    {
      "type": "REPORT",
      "url": "https://chromium.googlesource.com/chromium/deps/icu/+/dd727641e190d60e4593bcb3a35c7f51eb4925c5"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2015/02/05/15"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2522-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-9654"
    }
  ],
  "related": [
    "USN-2522-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2014-9654"
  ]
}

CVE-2014-9654 (GCVE-0-2014-9654)

Vulnerability from cvelistv5 – Published: 2017-04-24 06:12 – Updated: 2024-08-06 13:47

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat

References

9 references

URL	Tags
http://bugs.icu-project.org/trac/ticket/11371	x_refsource_CONFIRM
https://chromium.googlesource.com/chromium/deps/i…	x_refsource_CONFIRM
https://code.google.com/p/chromium/issues/detail?…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1035410	vdb-entryx_refsource_SECTRACK
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201503-06	vendor-advisoryx_refsource_GENTOO
http://bugs.icu-project.org/trac/changeset/36801	x_refsource_CONFIRM
http://openwall.com/lists/oss-security/2015/02/05/15	mailing-listx_refsource_MLIST
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC

Date Public

2014-11-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:41.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.icu-project.org/trac/ticket/11371"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://chromium.googlesource.com/chromium/deps/icu/+/dd727641e190d60e4593bcb3a35c7f51eb4925c5"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://code.google.com/p/chromium/issues/detail?id=432209"
          },
          {
            "name": "1035410",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035410"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "name": "GLSA-201503-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201503-06"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.icu-project.org/trac/changeset/36801"
          },
          {
            "name": "[oss-security] 20150205 Re: CVE request - ICU",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2015/02/05/15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-23T19:08:14.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.icu-project.org/trac/ticket/11371"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://chromium.googlesource.com/chromium/deps/icu/+/dd727641e190d60e4593bcb3a35c7f51eb4925c5"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://code.google.com/p/chromium/issues/detail?id=432209"
        },
        {
          "name": "1035410",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035410"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "name": "GLSA-201503-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201503-06"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.icu-project.org/trac/changeset/36801"
        },
        {
          "name": "[oss-security] 20150205 Re: CVE request - ICU",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2015/02/05/15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-9654",
    "datePublished": "2017-04-24T06:12:00.000Z",
    "dateReserved": "2015-02-05T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:47:41.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-2522-1

Vulnerability from osv_ubuntu

Published

2015-03-05 13:31

Modified

2026-04-22 07:36

Summary

icu vulnerabilities

Details

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)

It was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)

It was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940)

References

URL

Type

	https://ubuntu.com/security/notices/USN-2522-1	ADVISORY
	https://ubuntu.com/security/CVE-2013-1569	REPORT
	https://ubuntu.com/security/CVE-2013-2383	REPORT
	https://ubuntu.com/security/CVE-2013-2384	REPORT
	https://ubuntu.com/security/CVE-2013-2419	REPORT
	https://ubuntu.com/security/CVE-2014-6585	REPORT
	https://ubuntu.com/security/CVE-2014-6591	REPORT
	https://ubuntu.com/security/CVE-2014-7923	REPORT
	https://ubuntu.com/security/CVE-2014-7926	REPORT
	https://ubuntu.com/security/CVE-2014-7940	REPORT
	https://ubuntu.com/security/CVE-2014-9654	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-6585",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-6591",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-7923",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-7926",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-7940",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-9654",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icu-devtools",
            "binary_version": "52.1-3ubuntu0.2"
          },
          {
            "binary_name": "libicu52",
            "binary_version": "52.1-3ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "icu",
        "purl": "pkg:deb/ubuntu/icu@52.1-3ubuntu0.2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "52.1-3ubuntu0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.8.1.1-12ubuntu2",
        "4.8.1.1-13+nmu1",
        "4.8.1.1-13+nmu1ubuntu1",
        "52.1-3"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that ICU incorrectly handled memory operations when\nprocessing fonts. If an application using ICU processed crafted data, an\nattacker could cause it to crash or potentially execute arbitrary code with\nthe privileges of the user invoking the program. This issue only affected\nUbuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384,\nCVE-2013-2419)\n\nIt was discovered that ICU incorrectly handled memory operations when\nprocessing fonts. If an application using ICU processed crafted data, an\nattacker could cause it to crash or potentially execute arbitrary code with\nthe privileges of the user invoking the program. (CVE-2014-6585,\nCVE-2014-6591)\n\nIt was discovered that ICU incorrectly handled memory operations when\nprocessing regular expressions. If an application using ICU processed\ncrafted data, an attacker could cause it to crash or potentially execute\narbitrary code with the privileges of the user invoking the program.\n(CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)\n\nIt was discovered that ICU collator implementation incorrectly handled\nmemory operations. If an application using ICU processed crafted data, an\nattacker could cause it to crash or potentially execute arbitrary code with\nthe privileges of the user invoking the program. (CVE-2014-7940)\n",
  "id": "USN-2522-1",
  "modified": "2026-04-22T07:36:32Z",
  "published": "2015-03-05T13:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2522-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2013-1569"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2013-2383"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2013-2384"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2013-2419"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-6585"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-6591"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-7923"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-7926"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-7940"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9654"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "icu vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2013-1569",
    "UBUNTU-CVE-2013-2383",
    "UBUNTU-CVE-2013-2384",
    "UBUNTU-CVE-2013-2419",
    "UBUNTU-CVE-2014-6585",
    "UBUNTU-CVE-2014-6591",
    "UBUNTU-CVE-2014-7923",
    "UBUNTU-CVE-2014-7926",
    "UBUNTU-CVE-2014-7940",
    "UBUNTU-CVE-2014-9654"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2014-9654

Vulnerability from osv_ubuntu

CVE-2014-9654 (GCVE-0-2014-9654)

usn-2522-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature