Vulnerability record · CVE-2014-8147 · published 25 May 2015

CVE-2014-8147: Apple mac os x vulnerability

Apple · Mac Os X

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.

7.5 CVSS 2.0 High EPSS 23% · top 2.3% CWE-189 · CWE-189

7.5CVSS 2.0 base score

23%EPSS exploitation probability, 30 days

NoNot in CISA KEV

3Affected product versions listed by NVD

32References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Mac Os X Apple

Watchos Apple

International Components For Unicode Icu Project

References

Link	Tags
http://bugs.icu-project.org/trac/changeset/37080	Issue TrackingVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html	Mailing List
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	Mailing List
http://openwall.com/lists/oss-security/2015/05/05/6	Mailing List
http://seclists.org/fulldisclosure/2015/May/14	ExploitMailing ListThird Party Advisory
http://www.debian.org/security/2015/dsa-3323	Third Party Advisory
http://www.kb.cert.org/vuls/id/602540	Third Party AdvisoryUS Government Resource
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html	Patch
http://www.securityfocus.com/bid/74457	Third Party AdvisoryVDB Entry
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.
https://raw.githubusercontent.com/pedrib/PoC/master/generic/i-c-u-fail.txt	Exploit
https://security.gentoo.org/glsa/201507-04	Third Party Advisory
https://support.apple.com/HT205213	Third Party Advisory
https://support.apple.com/HT205267	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
http://bugs.icu-project.org/trac/changeset/37080	Issue TrackingVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html	Mailing List
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	Mailing List
http://openwall.com/lists/oss-security/2015/05/05/6	Mailing List
http://seclists.org/fulldisclosure/2015/May/14	ExploitMailing ListThird Party Advisory
http://www.debian.org/security/2015/dsa-3323	Third Party Advisory
http://www.kb.cert.org/vuls/id/602540	Third Party AdvisoryUS Government Resource
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html	Patch
http://www.securityfocus.com/bid/74457	Third Party AdvisoryVDB Entry
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.
https://raw.githubusercontent.com/pedrib/PoC/master/generic/i-c-u-fail.txt	Exploit
https://security.gentoo.org/glsa/201507-04	Third Party Advisory
https://support.apple.com/HT205213	Third Party Advisory
https://support.apple.com/HT205267	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Track CVE-2014-8147 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-24201Apple WebKit out-of-bounds write allows sandbox escapeCVE-2025-24201 is an out-of-bounds write in Apple's WebKit that was addressed with improved checks. Maliciously crafted web content may break out of …KEVEPSS 3.8%analysed11 Mar 2025 10.0CVE-2025-24085Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS Use-After-Free Privilege EscalationA use-after-free flaw in Apple's operating systems was fixed through improved memory management in iOS 18.3, iPadOS 18.3 and 17.7.6, macOS Sequoia 15…KEVEPSS 18%analysed27 Jan 2025 9.8CVE-2025-31200Apple OS media parsing memory corruption allows code executionA memory corruption flaw in Apple's audio stream processing was fixed with improved bounds checking across iOS, iPadOS, macOS, tvOS, visionOS and wat…KEVEPSS 19%analysed16 Apr 2025 9.8CVE-2021-1870Apple WebKit logic flaw allows remote code executionA logic issue in Apple's WebKit was addressed with improved restrictions, affecting macOS Big Sur, Catalina, Mojave, iOS and iPadOS, plus WebKitGTK a…KEVEPSS 7.7%analysed2 Apr 2021 9.8CVE-2021-1871Apple WebKit logic flaw allows remote code executionA logic issue in Apple's WebKit was addressed with improved restrictions. It affects macOS Big Sur, Catalina, Mojave, iOS and iPadOS, and a remote at…KEVEPSS 7.0%analysed2 Apr 2021 9.8CVE-2014-7169GNU Bash environment variable function parsing command injection (Shellshock variant)GNU Bash through 4.3 bash43-025 processes trailing strings after malformed function definitions in environment variable values, allowing command inje…KEVEPSS 100%analysed25 Sep 2014 9.8CVE-2014-6271GNU Bash environment variable command injection (ShellShock)GNU Bash through 4.3 processes trailing strings after function definitions in environment variable values, allowing injected commands to run when Bas…KEVEPSS 100%analysed24 Sep 2014 9.8CVE-2012-1823PHP-CGI query string option injection enables remote code executionPHP versions before 5.3.12 and 5.4.x before 5.4.2, when run as a CGI script (php-cgi), mishandle query strings that lack an equals sign, allowing com…KEVEPSS 100%analysed11 May 2012

Source: NIST National Vulnerability Database (record CVE-2014-8147), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.