Medium
Security advisory
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-15396
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:00 UTC · Revision 1
Source evidence
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
osv:CVE-2017-15396
Complete source record
{
"id": "b5f0ccc1bd5e80dea1f5d4c03c95b674a08f8a9cc9dd6f7a4c0664ebcc1cd953",
"url": "https://osv.dev/vulnerability/CVE-2017-15396",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-15396",
"summary": "A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"evidence": "osv:CVE-2017-15396",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-15396",
"aliases": [
"CVE-2017-15396"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/unicode-org/icu",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e387c69929ca8efd74b18c003818eaf1aa72796e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:icu-project:international_components_for_unicode:*:*:*:*:*:c\\/c\\+\\+:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "60.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"release-60-1",
"release-60-rc",
"milestone-60-0-1",
"release-59-rc",
"milestone-59-0-1",
"last-cvs-commit"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15396.json",
"vanir_signatures": [
{
"id": "CVE-2017-15396-0665be7a",
"digest": {
"length": 738,
"function_hash": "192840441545114378619813250366979318845"
},
"source": "https://github.com/unicode-org/icu/commit/e387c69929ca8efd74b18c003818eaf1aa72796e",
"target": {
"file": "icu4c/source/i18n/calendar.cpp",
"function": "Calendar::Calendar"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-15396-639f56a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325685802249717243591186478154447385681",
"330425111751708711986405029191010233063",
"302617518288185007915410602740154765375",
"65927760232024905311805398030519512192",
"220088122259980491942425324046117488059",
"334568181182330390454228188089148380707",
"70812089052326599596021665023762728037",
"325685802249717243591186478154447385681",
"330425111751708711986405029191010233063",
"302617518288185007915410602740154765375",
"65927760232024905311805398030519512192",
"11214167307563743030815599546084798569",
"32851899556968729898458798557357405502",
"183229318103647865732631129237705043188",
"325685802249717243591186478154447385681",
"330425111751708711986405029191010233063",
"302617518288185007915410602740154765375",
"65927760232024905311805398030519512192",
"11214167307563743030815599546084798569",
"32851899556968729898458798557357405502",
"183229318103647865732631129237705043188",
"140052210765090965669177173444601724255",
"57828577385504098153271804074135426384",
"263624532797666685604441857636028381824",
"101436063379484036608588423828308594749"
]
},
"source": "https://github.com/unicode-org/icu/commit/e387c69929ca8efd74b18c003818eaf1aa72796e",
"target": {
"file": "icu4c/source/i18n/calendar.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-15396-8515c455",
"digest": {
"length": 1156,
"function_hash": "313906442919399688347780690747714393675"
},
"source": "https://github.com/unicode-org/icu/commit/e387c69929ca8efd74b18c003818eaf1aa72796e",
"target": {
"file": "icu4c/source/i18n/calendar.cpp",
"function": "operator="
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-15396-951fc50c",
"digest": {
"length": 605,
"function_hash": "36907280711190410477535904309479707110"
},
"source": "https://github.com/unicode-org/icu/commit/e387c69929ca8efd74b18c003818eaf1aa72796e",
"target": {
"file": "icu4c/source/i18n/calendar.cpp",
"function": "Calendar::Calendar"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-15396-b6217108",
"digest": {
"length": 618,
"function_hash": "213150955025431990309305928145694457188"
},
"source": "https://github.com/unicode-org/icu/commit/e387c69929ca8efd74b18c003818eaf1aa72796e",
"target": {
"file": "icu4c/source/i18n/calendar.cpp",
"function": "Calendar::Calendar"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:03:17Z"
}
}
],
"modified": "2026-10-24T14:03:17.969915030Z",
"provider": "osv",
"references": [
"https://crbug.com/770452",
"https://access.redhat.com/errata/RHSA-2017:3082",
"https://security.gentoo.org/glsa/201711-02",
"https://www.debian.org/security/2017/dsa-4020",
"https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"
],
"vendor_product": "google:chrome",
"extracted_events": [
{
"range": [
{
"fixed": "62.0.3202.75"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_workstation",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-15396",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442781,
"published_at": "2018-08-28T20:29:00.233+00:00"
}