Andre Bargull discovered an integer overflow in the International Components for Unicode (ICU) library which could result in denial of service and potentially the execution of arbitrary code. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4646-1
It was discovered that icu, the International Components for Unicode library, did not correctly validate its input. An attacker could use this problem to trigger an out-of-bound write through a heap-based buffer overflow, thus causing a denial of service via application . Hash: SHA512 Package : icu Version : 4.8.1.1-12+deb7u7 CVE ID : CVE-2017-7867 CVE-2017-7868 It was discovered that icu, the International Components for Unicode library, did not correctly validate its input. An attacker could use this problem to trigger an out-of-bound write through a heap-based buffer overflow, thus causing a denial of service via application crash, or potential execution of arbitrary code. For Debian 7 "Wheezy", these problems have been fixed in version 4.8.1.1-12+deb7u7. We recommend that you upgrade your icu packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . A patch for icu on Debian LTS addresses a critical buffer overflow issue that may result in denial of service and the possibility of remote code execution.. Debian Updates, Buffer Overflow Fix, icu Library Security, Denial of Service, Software Patch. . Severity: Critical. LinuxSecurity.com Team
It was discovered that the International Components for Unicode (ICU) library mishandles converter names starting with x- , which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3360-1
Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: icu security update Advisory ID: RHSA-2009:1122-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:1122.html Issue date: 2009-06-25 CVE Names: CVE-2009-0153 ==================================================================== 1. Summary: Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2009-0153) All users of icu should upgrade to these updated packages, which contain backported patches to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 503071 - CVE-2009-0153 icu: XSS vulnerability due to improper invalid byte sequencehandling 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: icu-3.6-5.11.4.i386.rpm icu-debuginfo-3.6-5.11.4.i386.rpm libicu-3.6-5.11.4.i386.rpm libicu-doc-3.6-5.11.4.i386.rpm x86_64: icu-3.6-5.11.4.x86_64.rpm icu-debuginfo-3.6-5.11.4.i386.rpm icu-debuginfo-3.6-5.11.4.x86_64.rpm libicu-3.6-5.11.4.i386.rpm libicu-3.6-5.11.4.x86_64.rpm libicu-doc-3.6-5.11.4.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: i386: icu-debuginfo-3.6-5.11.4.i386.rpm libicu-devel-3.6-5.11.4.i386.rpm x86_64: icu-debuginfo-3.6-5.11.4.i386.rpm icu-debuginfo-3.6-5.11.4.x86_64.rpm libicu-devel-3.6-5.11.4.i386.rpm libicu-devel-3.6-5.11.4.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: icu-3.6-5.11.4.i386.rpm icu-debuginfo-3.6-5.11.4.i386.rpm libicu-3.6-5.11.4.i386.rpm libicu-devel-3.6-5.11.4.i386.rpm libicu-doc-3.6-5.11.4.i386.rpm ia64: icu-3.6-5.11.4.ia64.rpm icu-debuginfo-3.6-5.11.4.ia64.rpm libicu-3.6-5.11.4.ia64.rpm libicu-devel-3.6-5.11.4.ia64.rpm libicu-doc-3.6-5.11.4.ia64.rpm ppc: icu-3.6-5.11.4.ppc.rpm icu-debuginfo-3.6-5.11.4.ppc.rpm icu-debuginfo-3.6-5.11.4.ppc64.rpm libicu-3.6-5.11.4.ppc.rpm libicu-3.6-5.11.4.ppc64.rpm libicu-devel-3.6-5.11.4.ppc.rpm libicu-devel-3.6-5.11.4.ppc64.rpm libicu-doc-3.6-5.11.4.ppc.rpm s390x: icu-3.6-5.11.4.s390x.rpm icu-debuginfo-3.6-5.11.4.s390.rpm icu-debuginfo-3.6-5.11.4.s390x.rpm libicu-3.6-5.11.4.s390.rpm libicu-3.6-5.11.4.s390x.rpm libicu-devel-3.6-5.11.4.s390.rpm libicu-devel-3.6-5.11.4.s390x.rpm libicu-doc-3.6-5.11.4.s390x.rpm x86_64: icu-3.6-5.11.4.x86_64.rpm icu-debuginfo-3.6-5.11.4.i386.rpm icu-debuginfo-3.6-5.11.4.x86_64.rpm libicu-3.6-5.11.4.i386.rpm libicu-3.6-5.11.4.x86_64.rpm libicu-devel-3.6-5.11.4.i386.rpm libicu-devel-3.6-5.11.4.x86_64.rpm libicu-doc-3.6-5.11.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7.References: https://www.cve.org/CVERecord?id=CVE-2009-0153 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2009 Red Hat, Inc. . Important security enhancement for CentOS 6 provides vital patches and resolves significant vulnerabilities.. Enterprise Linux, ICU security, Red Hat update, security patch. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.