ArchLinux: 201711-26: lib32-icu: arbitrary code execution
Summary
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.
Resolution
Upgrade to 60.1-1.
# pacman -Syu "lib32-icu>=60.1-1"
The problem has been fixed upstream in version 60.1.
References
https://unicode-org.atlassian.net https://www.sourcebrella.com/blog/double-free-vulnerability-international-components-unicode-icu/ https://security.archlinux.org/CVE-2017-14952
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.