ZeroDay Findings
Sign inSign up

Findings

CVE-2017-15422

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other

Published Aug 28, 2018 · updated Oct 14, 2026 · google chrome

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 28, 2018 · NIST NVD

    Detected

    Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

  3. Oct 14, 2026 · OSV.dev

    Fix available

    icu fixed in 57.1-9; icu fixed in 57.1-9; icu fixed in 57.1-9

  4. Oct 14, 2026 · OSV.dev

    Fix available

    icu fixed in 57.1-9

  5. Oct 14, 2026 · OSV.dev

    Updated

    Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

  6. Oct 14, 2026 · OSV.dev

    Updated

    Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

  7. Oct 14, 2026 · OSV.dev

    Updated

    Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Affected

  • Debian:12 icu0 → 57.1-9
  • Debian:13 icu0 → 57.1-9
  • Debian:14 icu0 → 57.1-9
  • cpe canonical/ubuntu linux14.04
  • cpe canonical/ubuntu linux16.04
  • cpe canonical/ubuntu linux17.10
  • cpe debian/debian linux8.0
  • cpe debian/debian linux9.0
  • cpe google/chromeversion unspecified
  • cpe icu-project/international components for unicodeversion unspecified
  • cpe redhat/enterprise linux desktop6.0

Sources

  • CVE.orgVulnerability recordCVE-2017-15422

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2017-15422

    30-day exploitation probability 2.5%

    first.org
  • NIST NVDVulnerability recordCVE-2017-15422

    Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2017-15422
    osv.dev

References