---
id: CVE-2017-15422
title: >-
  Integer overflow in international date handling in International Components
  for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior
  to 63.0.3239.84 and other products, allowed a remote attacker to perform an
  out of …
summary: >-
  Integer overflow in international date handling in International Components
  for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior
  to 63.0.3239.84 and other products, allowed a remote attacker to perform an
  out of …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-190
vendor: google
product: chrome
affected:
  - chrome < 63.0.3239.84
  - international_components_for_unicode < 60.1
  - debian_linux = 8.0
  - debian_linux = 9.0
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 17.10
  - enterprise_linux_desktop = 6.0
  - enterprise_linux_server = 6.0
  - enterprise_linux_workstation = 6.0
patched:
  - chrome 63.0.3239.84
  - international_components_for_unicode 60.1
published: '2018-08-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:39.267'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-15422'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2017:3401'
    label: chrome-cve-admin@google.com
  - url: >-
      https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
    label: chrome-cve-admin@google.com
  - url: 'https://crbug.com/774382'
    label: chrome-cve-admin@google.com
  - url: 'https://security.gentoo.org/glsa/201801-03'
    label: chrome-cve-admin@google.com
  - url: 'https://usn.ubuntu.com/3610-1/'
    label: chrome-cve-admin@google.com
  - url: 'https://www.debian.org/security/2018/dsa-4150'
    label: chrome-cve-admin@google.com
  - url: 'https://access.redhat.com/errata/RHSA-2017:3401'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://crbug.com/774382'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/201801-03'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/3610-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2018/dsa-4150'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-15422.json
  - url: 'https://access.redhat.com/security/cve/CVE-2017-15422'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1523136'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2017-15422'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-15422'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.02536
epssPercentile: 0.84855
ingestedAt: '2026-10-14T07:21:04.802Z'
---

## Overview

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

## Affected

- `chrome < 63.0.3239.84`
- `international_components_for_unicode < 60.1`
- `debian_linux = 8.0`
- `debian_linux = 9.0`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 17.10`
- `enterprise_linux_desktop = 6.0`
- `enterprise_linux_server = 6.0`
- `enterprise_linux_workstation = 6.0`

## Remediation

Upgrade past the affected range:

- `chrome 63.0.3239.84`
- `international_components_for_unicode 60.1`

## Vendor advisories

- **RHSA-2017:3401** · Red Hat · fixed in: Red Hat Enterprise Linux Desktop Supplementary (v. 6), Red Hat Enterprise Linux Server Supplementary (v. 6), Red Hat Enterprise Linux Workstation Supplementary (v. 6) · released 2017-12-07 · [advisory](https://access.redhat.com/errata/RHSA-2017:3401)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-15422.json)