{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "regexp engine incorrect handling of a zero length quantifier",
    "tracking": {
      "current_release_date": "2026-08-11T14:02:14+00:00",
      "generator": {
        "date": "2026-08-11T14:02:14+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2014-7926",
      "initial_release_date": "2015-01-21T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T14:02:14+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 5.11",
            "product": {
              "name": "Red Hat Enterprise Linux 5.11",
              "product_id": "rhel-5.11.z.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:5"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6-els",
            "product": {
              "name": "Red Hat Enterprise Linux 6-els",
              "product_id": "rhel-6-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6.6",
            "product": {
              "name": "Red Hat Enterprise Linux 6.6",
              "product_id": "rhel-6.6.z.extras",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:rhel_extras:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6.7",
            "product": {
              "name": "Red Hat Enterprise Linux 6.7",
              "product_id": "rhel-6.7.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 7-els",
            "product": {
              "name": "Red Hat Enterprise Linux 7-els",
              "product_id": "rhel-7-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:7"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser",
            "product": {
              "name": "chromium-browser",
              "product_id": "chromium-browser-0:40.0.2214.91-1.el6_6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser@40.0.2214.91-1.el6_6?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser",
            "product": {
              "name": "chromium-browser",
              "product_id": "chromium-browser-0:40.0.2214.91-1.el6_6.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser@40.0.2214.91-1.el6_6?arch=src&epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser-debuginfo",
            "product": {
              "name": "chromium-browser-debuginfo",
              "product_id": "chromium-browser-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser",
            "product": {
              "name": "chromium-browser",
              "product_id": "chromium-browser.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "icu",
            "product": {
              "name": "icu",
              "product_id": "icu",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/icu"
              }
            }
          },
          {
            "category": "product_version",
            "name": "icu-debuginfo",
            "product": {
              "name": "icu-debuginfo",
              "product_id": "icu-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/icu-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "icu",
            "product": {
              "name": "icu",
              "product_id": "icu.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/icu?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libicu",
            "product": {
              "name": "libicu",
              "product_id": "libicu",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libicu"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libicu-devel",
            "product": {
              "name": "libicu-devel",
              "product_id": "libicu-devel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libicu-devel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libicu-doc",
            "product": {
              "name": "libicu-doc",
              "product_id": "libicu-doc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libicu-doc"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser-0:40.0.2214.91-1.el6_6 as a component of Red Hat Enterprise Linux 6.6",
          "product_id": "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6"
        },
        "product_reference": "chromium-browser-0:40.0.2214.91-1.el6_6",
        "relates_to_product_reference": "rhel-6.6.z.extras"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser-0:40.0.2214.91-1.el6_6.src as a component of Red Hat Enterprise Linux 6.6",
          "product_id": "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src"
        },
        "product_reference": "chromium-browser-0:40.0.2214.91-1.el6_6.src",
        "relates_to_product_reference": "rhel-6.6.z.extras"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser-debuginfo as a component of Red Hat Enterprise Linux 6.6",
          "product_id": "rhel-6.6.z.extras:chromium-browser-debuginfo"
        },
        "product_reference": "chromium-browser-debuginfo",
        "relates_to_product_reference": "rhel-6.6.z.extras"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser.src as a component of Red Hat Enterprise Linux 6.7",
          "product_id": "rhel-6.7.els:chromium-browser.src"
        },
        "product_reference": "chromium-browser.src",
        "relates_to_product_reference": "rhel-6.7.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:icu"
        },
        "product_reference": "icu",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:icu"
        },
        "product_reference": "icu",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu-debuginfo as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:icu-debuginfo"
        },
        "product_reference": "icu-debuginfo",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu-debuginfo as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:icu-debuginfo"
        },
        "product_reference": "icu-debuginfo",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu.src as a component of Red Hat Enterprise Linux 5.11",
          "product_id": "rhel-5.11.z.els:icu.src"
        },
        "product_reference": "icu.src",
        "relates_to_product_reference": "rhel-5.11.z.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu.src as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:icu.src"
        },
        "product_reference": "icu.src",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "icu.src as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:icu.src"
        },
        "product_reference": "icu.src",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libicu"
        },
        "product_reference": "libicu",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libicu"
        },
        "product_reference": "libicu",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-devel as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libicu-devel"
        },
        "product_reference": "libicu-devel",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-devel as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libicu-devel"
        },
        "product_reference": "libicu-devel",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-doc as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libicu-doc"
        },
        "product_reference": "libicu-doc",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libicu-doc as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libicu-doc"
        },
        "product_reference": "libicu-doc",
        "relates_to_product_reference": "rhel-6-els.els"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-7926",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2015-01-22T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-6-els.els:icu-debuginfo",
            "rhel-6-els.els:libicu-devel",
            "rhel-6-els.els:libicu-doc",
            "rhel-6.6.z.extras:chromium-browser-debuginfo",
            "rhel-7-els.els:icu-debuginfo",
            "rhel-7-els.els:libicu-devel",
            "rhel-7-els.els:libicu-doc"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "The flaw is caused because the ICU regular expression compiler is unable to properly handle certain malformed patterns. Because of the way in which this flaw manifests itself, it can only be triggered via untrusted content, which is common for components such as web browsers, in this case, the Chromium browser. \n\nThis flaw has been rated moderate for ICU component in Red Hat products, because either it is very difficult to trigger this flaw, or it is unusual to directly pass untrusted parameters to the ICU library.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
          "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src"
        ],
        "known_affected": [
          "rhel-5.11.z.els:icu.src",
          "rhel-6-els.els:icu",
          "rhel-6-els.els:icu.src",
          "rhel-6-els.els:libicu",
          "rhel-6.7.els:chromium-browser.src",
          "rhel-7-els.els:icu",
          "rhel-7-els.els:icu.src",
          "rhel-7-els.els:libicu"
        ],
        "known_not_affected": [
          "rhel-6-els.els:icu-debuginfo",
          "rhel-6-els.els:libicu-devel",
          "rhel-6-els.els:libicu-doc",
          "rhel-6.6.z.extras:chromium-browser-debuginfo",
          "rhel-7-els.els:icu-debuginfo",
          "rhel-7-els.els:libicu-devel",
          "rhel-7-els.els:libicu-doc"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-7926"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7926"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-7926"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "rhel-5.11.z.els:icu.src",
            "rhel-6-els.els:icu",
            "rhel-6-els.els:icu.src",
            "rhel-6-els.els:libicu",
            "rhel-7-els.els:icu",
            "rhel-7-els.els:icu.src",
            "rhel-7-els.els:libicu"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "rhel-6.7.els:chromium-browser.src"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2015-01-27T18:46:27+00:00",
          "details": "Apply advisory RHSA-2015:0093 as per vendors instructions.",
          "product_ids": [
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2015:0093"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "version": "2.0",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "baseScore": 6.8
          },
          "products": [
            "rhel-5.11.z.els:icu.src",
            "rhel-6-els.els:icu",
            "rhel-6-els.els:icu-debuginfo",
            "rhel-6-els.els:icu.src",
            "rhel-6-els.els:libicu",
            "rhel-6-els.els:libicu-devel",
            "rhel-6-els.els:libicu-doc",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src",
            "rhel-6.6.z.extras:chromium-browser-debuginfo",
            "rhel-6.7.els:chromium-browser.src",
            "rhel-7-els.els:icu",
            "rhel-7-els.els:icu-debuginfo",
            "rhel-7-els.els:icu.src",
            "rhel-7-els.els:libicu",
            "rhel-7-els.els:libicu-devel",
            "rhel-7-els.els:libicu-doc"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src",
            "rhel-6.6.z.extras:chromium-browser-debuginfo",
            "rhel-6.7.els:chromium-browser.src"
          ]
        },
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhel-5.11.z.els:icu.src",
            "rhel-6-els.els:icu",
            "rhel-6-els.els:icu-debuginfo",
            "rhel-6-els.els:icu.src",
            "rhel-6-els.els:libicu",
            "rhel-6-els.els:libicu-devel",
            "rhel-6-els.els:libicu-doc",
            "rhel-7-els.els:icu",
            "rhel-7-els.els:icu-debuginfo",
            "rhel-7-els.els:icu.src",
            "rhel-7-els.els:libicu",
            "rhel-7-els.els:libicu-devel",
            "rhel-7-els.els:libicu-doc"
          ]
        }
      ],
      "title": "regexp engine incorrect handling of a zero length quantifier"
    }
  ]
}