CVE-2017-15422

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	Google Chrome prior to 63.0.3239.84 unknown	Google Chrome prior to 63.0.3239.84 unknown
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

Timeline

Published: Aug 28, 2018
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-154235.3Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits CVE-2017-154246.5Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via I CVE-2017-154256.5Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via I CVE-2017-154266.5Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via I CVE-2017-154276.1Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dr CVE-2017-154288.8Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior CVE-2017-154296.1Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbit CVE-2017-154304.3Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scrip CVE-2017-15447.8IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) caches usernames and passwords in browsers that CVE-2017-15456.8IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously sto CVE-2017-15465.4IBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit CVE-2017-15485.3IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafte