CVE catalog

CVE-2014-7923

icu affected and fixed versions

The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a look-behind expression.

Severity: Medium
Published: Jan 1, 2014, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.22% · Oct 27, 2026

Projects and upstream resources

[icu][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debiantrixie	icu	`76.1-4`	Fixed	[CVE-2014-7923]
Debiansid	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debiansid	icu	`78.3-2`	Fixed	[CVE-2014-7923]
Debianforky	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debianforky	icu	`78.3-2`	Fixed	[CVE-2014-7923]
Debianbookworm-security	icu	`72.1-3+deb12u1`	Fixed	[CVE-2014-7923]
Debianbookworm	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debianbookworm	icu	`72.1-3+deb12u1`	Fixed	[CVE-2014-7923]

Showing 9 fix observations. All 37 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debianbookworm	icu	`72.1-3+deb12u1`	Fixed	[CVE-2014-7923]
Debianbookworm-security	icu	`72.1-3+deb12u1`	Fixed	[CVE-2014-7923]
Debianforky	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debianforky	icu	`78.3-2`	Fixed	[CVE-2014-7923]
Debiansid	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debiansid	icu	`78.3-2`	Fixed	[CVE-2014-7923]
Debiantrixie	icu	`52.1-7.1`	FixedDistribution-reported fixed boundary	[CVE-2014-7923]
Debiantrixie	icu	`76.1-4`	Fixed	[CVE-2014-7923]
Ubuntu14.04	chromium-browser	`29.0.1547.65-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`31.0.1650.63-0ubuntu1~20131204.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`32.0.1700.107-0ubuntu1~20140204.977.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`33.0.1750.152-0ubuntu1~pkg995.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`34.0.1847.116-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`36.0.1985.125-0ubuntu1.14.04.0~pkg1029`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`37.0.2062.120-0ubuntu0.14.04.1~pkg1049`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`37.0.2062.94-0ubuntu0.14.04.1~pkg1042`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`38.0.2125.111-0ubuntu0.14.04.1.1061`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`39.0.2171.65-0ubuntu0.14.04.1.1064`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	chromium-browser	`40.0.2214.94-0ubuntu0.14.04.1.1068`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	icu	`4.8.1.1-12ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	icu	`4.8.1.1-13+nmu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	icu	`4.8.1.1-13+nmu1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	icu	`52.1-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	icu	`52.1-3ubuntu0.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC
Ubuntu14.04	oxide-qt	`1.0.0~bzr437-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.0~bzr452-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.0~bzr475-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.0~bzr490-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.0~bzr501-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.0~bzr501-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.4-0ubuntu0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.0.5-0ubuntu0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.1.2-0ubuntu0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.2.5-0ubuntu0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.3.4-0ubuntu0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC
Ubuntu14.04	oxide-qt	`1.4.2-0ubuntu0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2014-7923]Apr 22, 2026, 9:49:41 AM UTC[USN-2476-1]Feb 10, 2026, 4:40:51 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "icu",
      "status": "fixed",
      "release": "sid",
      "version": "78.3-2"
    },
    {
      "name": "icu",
      "status": "fixed",
      "release": "forky",
      "version": "78.3-2"
    },
    {
      "name": "icu",
      "status": "fixed",
      "release": "trixie",
      "version": "76.1-4"
    },
    {
      "name": "icu",
      "status": "fixed",
      "release": "bookworm",
      "version": "72.1-3+deb12u1"
    },
    {
      "name": "icu",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "72.1-3+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 776265,
      "name": "icu",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "52.1-7.1"
    },
    {
      "bug": 776265,
      "name": "icu",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "52.1-7.1"
    },
    {
      "bug": 776265,
      "name": "icu",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "52.1-7.1"
    },
    {
      "bug": 776265,
      "name": "icu",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "52.1-7.1"
    }
  ],
  "distribution_packages": [
    {
      "name": "chromium-browser",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "40.0.2214.94-0ubuntu0.14.04.1.1068"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "29.0.1547.65-0ubuntu2",
        "31.0.1650.63-0ubuntu1~20131204.1",
        "32.0.1700.107-0ubuntu1~20140204.977.1",
        "33.0.1750.152-0ubuntu1~pkg995.1",
        "34.0.1847.116-0ubuntu2",
        "36.0.1985.125-0ubuntu1.14.04.0~pkg1029",
        "37.0.2062.94-0ubuntu0.14.04.1~pkg1042",
        "37.0.2062.120-0ubuntu0.14.04.1~pkg1049",
        "38.0.2125.111-0ubuntu0.14.04.1.1061",
        "39.0.2171.65-0ubuntu0.14.04.1.1064"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2014-7923",
      "fixed_version": "40.0.2214.94-0ubuntu0.14.04.1.1068",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2014-7923",
      "provider_updated_at": "2026-04-22T09:49:41.874397Z",
      "applicability_unknown": true
    },
    {
      "name": "icu",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "52.1-3ubuntu0.2"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "4.8.1.1-12ubuntu2",
        "4.8.1.1-13+nmu1",
        "4.8.1.1-13+nmu1ubuntu1",
        "52.1-3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2014-7923",
      "fixed_version": "52.1-3ubuntu0.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2014-7923",
      "provider_updated_at": "2026-04-22T09:49:41.874397Z",
      "applicability_unknown": true
    },
    {
      "name": "oxide-qt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2-0ubuntu0.14.04.1"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "1.0.0~bzr437-0ubuntu1",
        "1.0.0~bzr452-0ubuntu1",
        "1.0.0~bzr475-0ubuntu1",
        "1.0.0~bzr490-0ubuntu1",
        "1.0.0~bzr501-0ubuntu1",
        "1.0.0~bzr501-0ubuntu2",
        "1.0.4-0ubuntu0.14.04.1",
        "1.0.5-0ubuntu0.14.04.1",
        "1.1.2-0ubuntu0.14.04.1",
        "1.2.5-0ubuntu0.14.04.1",
        "1.3.4-0ubuntu0.14.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2014-7923",
      "fixed_version": "1.4.2-0ubuntu0.14.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2014-7923",
      "provider_updated_at": "2026-04-22T09:49:41.874397Z",
      "applicability_unknown": true
    },
    {
      "name": "oxide-qt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2-0ubuntu0.14.04.1"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "1.0.0~bzr437-0ubuntu1",
        "1.0.0~bzr452-0ubuntu1",
        "1.0.0~bzr475-0ubuntu1",
        "1.0.0~bzr490-0ubuntu1",
        "1.0.0~bzr501-0ubuntu1",
        "1.0.0~bzr501-0ubuntu2",
        "1.0.4-0ubuntu0.14.04.1",
        "1.0.5-0ubuntu0.14.04.1",
        "1.1.2-0ubuntu0.14.04.1",
        "1.2.5-0ubuntu0.14.04.1",
        "1.3.4-0ubuntu0.14.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-2476-1",
      "fixed_version": "1.4.2-0ubuntu0.14.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-2476-1",
      "provider_updated_at": "2026-02-10T04:40:51Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #776265]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[icu-devtools]Unknown
Source package: [icu]
Details (4)
- 72.1-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
[icu-doc]Unknown
Source package: [icu]
Details (4)
- 72.1-3+deb12u1 · all · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · all · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · all · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · all · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
[libicu72]Unknown
Source package: [icu]
Details (4)
- 72.1-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
[libicu-dev]Unknown
Source package: [icu]
Details (4)
- 72.1-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12
- 72.1-3+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · bookworm; dsa · icu · debian · 12

[Debian 13 (Trixie)]

[icu-devtools]Unknown
Source package: [icu]
Details (2)
- 76.1-4 · amd64 · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
- 76.1-4 · arm64 · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
[icu-doc]Unknown
Source package: [icu]
Details (2)
- 76.1-4 · all · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
- 76.1-4 · all · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
[libicu76]Unknown
Source package: [icu]
Details (2)
- 76.1-4 · amd64 · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
- 76.1-4 · arm64 · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
[libicu-dev]Unknown
Source package: [icu]
Details (2)
- 76.1-4 · amd64 · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13
- 76.1-4 · arm64 · trixie
  Fixed · Fixed: 52.1-7.1
  dsa · icu · debian · 13

Observed: Oct 23, 2026, 5:11:47 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]