CVE-2014-7923

What it actually does

The Regular Expressions package in ICU 52 before SVN revision 292944 allows remote attackers to trigger memory corruption via specially crafted look-behind expressions, potentially leading to denial of service or other unspecified impacts.

Why it matters to the business

Systems using affected ICU versions in browsers, enterprise messaging, or Linux distributions face risk of application crashes or code execution, which could disrupt services across widely deployed environments even years after disclosure.

How an attack unfolds

An attacker supplies a malicious regular expression containing a crafted look-behind assertion to an application that processes it with the vulnerable ICU library, such as through web content in older Chrome or input handling in server software, triggering memory corruption.

How to fix it

Upgrade ICU to a version after SVN revision 292944, or apply vendor patches for affected products including Chrome 40.0.2214.91 and later, Red Hat Enterprise Linux supplementary channels, Ubuntu, openSUSE, and Oracle Communications Messaging Server.

How to confirm the fix worked

Confirm ICU version exceeds SVN 292944 or product is at patched release level; test regex processing with known look-behind patterns to ensure no crashes occur.

Typical attack path

1. Identify target application using vulnerable ICU regex processing
2. Craft malicious regex containing look-behind expression
3. Deliver regex via web page, message, or user input
4. Trigger processing to induce memory corruption
5. Leverage corruption for denial of service or potential code execution

How to detect it

Review application crash logs for ICU regex-related memory faults; search web or input logs for unusual look-behind regex patterns delivered to vulnerable endpoints.

What your security team should do

• Prioritize patching Chrome and ICU-dependent applications due to broad ecosystem presence
• Inventory systems for vulnerable ICU versions across Red Hat, Ubuntu, and openSUSE deployments
• Monitor network traffic and application logs for anomalous regex handling
• Apply updates before considering any workarounds since no fixed versions are listed in current data