CVE-2017-15396 describes a stack buffer overflow vulnerability in the International Components for Unicode (ICU) library, specifically affecting versions prior to 60.2. This flaw, present in products like Google Chrome (prior to 62.0.3202.75), Debian, and Red Hat, could allow a remote attacker to trigger heap corruption via a specially crafted HTML page. With a CVSS score of 6.5 (Medium), it requires user interaction (UI:R) but can lead to high availability impact (A:H). While there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB) is unavailable, and community discussion is minimal, though it has received some media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 62.0.3202.75CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.