Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 13.04 LTS USN-1989-1 Critical ICU Code Execution Threat

ubuntu
Calendar Grey October 15, 2013
Scroller Ubuntu
ICU for Ubuntu has security vulnerabilities that may allow unauthorized code execution or system crashes with certain data. Update your system for better protection
ICU could be made to crash or run programs as your login if it processed specially crafted data.

Summary

ICU could be made to crash or run programs as your login if it processed

specially crafted data.

Software Description:

- icu: International Components for Unicode library

Details:

It was discovered that ICU contained a race condition affecting multi-threaded applications. If an application using ICU processed crafted data,

an attacker could cause it to crash or potentially execute arbitrary code

with the privileges of the user invoking the program. This issue only

affected Ubuntu 12.04 LTS and Ubuntu 12.10. (CVE-2013-0900)

It was discovered that ICU incorrectly handled memory operations. If an

application using ICU processed crafted data, an attacker could cause it to

crash or potentially execute arbitrary code with the privileges of the user

invoking the program. (CVE-2013-2924)

Topics%20covered

Topics Covered

security advisory update critical code execution Ubuntu memory error ICU

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  libicu48                        4.8.1.1-12ubuntu0.1

Ubuntu 12.10:
  libicu48                        4.8.1.1-8ubuntu0.1

Ubuntu 12.04 LTS:
  libicu48                        4.8.1.1-3ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1989-1

CVE-2013-0900, CVE-2013-2924

Severity
critical
Lowest
Low
Medium
High
Critical

October 15, 2013

Topics%20covered

Topics Covered

security advisory update critical code execution Ubuntu memory error ICU

Package Information

https://launchpad.net/ubuntu/+source/icu/4.8.1.1-12ubuntu0.1
https://launchpad.net/ubuntu/+source/icu/4.8.1.1-8ubuntu0.1
https://launchpad.net/ubuntu/+source/icu/4.8.1.1-3ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.