Ubuntu 11.10: 1348-1 Critical: ICU Crash and Code Execution Threat

ubuntu

January 26, 2012

ICU could be made to crash or run programs as your login if it opened specially crafted data.

Summary

ICU could be made to crash or run programs as your login if it

opened specially crafted data.

Software Description:

- icu: International Components for Unicode library

Details:

It was discovered that ICU did not properly handle invalid locale data

during Unicode conversion. If an application using ICU processed crafted

data, an attacker could cause it to crash or potentially execute arbitrary

code with the privileges of the user invoking the program.

Topics Covered

security advisory code execution update instructions ubuntu icu crash

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libicu44                        4.4.2-2ubuntu0.11.10.1

Ubuntu 11.04:
  libicu44                        4.4.2-2ubuntu0.11.04.1

Ubuntu 10.10:
  libicu42                        4.2.1-3ubuntu0.10.10.1

Ubuntu 10.04 LTS:
  libicu42                        4.2.1-3ubuntu0.10.04.1

In general, a standard system update will make all the necessary changes.