CVE-2014-7940

Vulnerability

A memory initialization flaw exists in the collator implementation within i18n/ucol.cpp of International Components for Unicode (ICU) version 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91. The bug is triggered when processing a crafted character sequence, leading to the use of uninitialized memory for a data structure [1][2][4].

Exploitation

An attacker can exploit this vulnerability remotely by supplying a specially crafted character sequence to an application that uses the affected ICU collator, such as Google Chrome. No authentication is required; the attack is network-based, relying on user interaction to process the malicious input [1][2].

Impact

Successful exploitation can cause a denial of service (memory corruption) through application crash or potentially lead to other unspecified impacts. The vulnerability does not immediately grant code execution, but memory corruption may be leveraged for further compromise [1][2].

Mitigation

The issue is fixed in ICU updates incorporated into Google Chrome 40.0.2214.91 [1][2]. Red Hat and Mageia have released updated ICU packages (e.g., icu-52.1-2.1.mga4 for Mageia 4) that address this and related vulnerabilities [1][2]. Users should apply the latest patches from their software vendors.