CVE-2017-14952

What it actually does

Double free in ICU i18n/zonemeta.cpp allows remote attackers to execute arbitrary code via a crafted string that triggers redundant UVector cleanup.

Why it matters to the business

Attackers can gain full control of affected systems processing untrusted input, potentially leading to data theft, ransomware deployment, or service disruption on older Ubuntu deployments of Firefox and Thunderbird.

How an attack unfolds

An attacker crafts a malicious string and delivers it to an application using vulnerable ICU (through 59.1) such as Firefox or Thunderbird; the string triggers a double-free condition in zonemeta.cpp, corrupting memory and allowing arbitrary code execution.

How to fix it

Upgrade Firefox to 53.0+build6-0ubuntu0.14.04.1 and Thunderbird to 1:52.1.1+build1-0ubuntu0.14.04.1 (or later) on Ubuntu 14.04 LTS; apply equivalent ICU updates in other products.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed versions; test with known ICU double-free PoCs if available in isolated environments; confirm ICU library version <=59.1 is no longer present.

Typical attack path

1. Identify target application using vulnerable ICU version
2. Craft and deliver malicious string via network or file
3. Trigger double-free in i18n/zonemeta.cpp
4. Achieve memory corruption and execute attacker-controlled code

How to detect it

Review application logs, crash reports, and memory dumps for signs of ICU-related double-free crashes when processing external strings; correlate with network or file ingestion events around the time of suspected compromise.

What your security team should do

• Prioritize patching affected Ubuntu Firefox and Thunderbird instances immediately due to remote code execution severity
• Scan for any other applications linking against ICU <=59.1 and schedule upgrades
• Monitor EPSS and exploit maturity trends for any increase in public tooling