Stay Secure with the Latest Linux Advisories

security advisoryhigh severitygentoo

Gentoo: GLSA-200803-20 High: Unicode Libraries Risk Remote Code Execution

Two vulnerabilities have been discovered in the International Components for Unicode, possibly resulting in the remote execution of arbitrary code or a Denial of Service. [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: International Components for Unicode: Multiple vulnerabilities Date: March 11, 2008 Bugs: #208001 ID: 200803-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Two vulnerabilities have been discovered in the International Components for Unicode, possibly resulting in the remote execution of arbitrary code or a Denial of Service. Background ========= International Components for Unicode is a set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/icu < 3.8.1-r1 > = 3.8.1-r1 Description ========== Will Drewry (Google Security) reported a vulnerability in the regular expression engine when using back references to capture \0 characters(CVE-2007-4770). He also found that the backtracking stack size is not limited, possibly allowing for a heap-based buffer overflow (CVE-2007-4771). Impact ===== A remote attacker could submit specially crafted regular expressions to an application using the library, possibly resulting in the remote execution of arbitrary code with the privileges of theuser running the application or a Denial of Service. Workaround ========= There is no known workaround at this time. Resolution ========= All International Components for Unicode users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-libs/icu-3.8.1-r1" References ========= [ 1 ] CVE-2007-4770 https://www.cve.org/CVERecord?id=CVE-2007-4770 [ 2 ] CVE-2007-4771 https://www.cve.org/CVERecord?id=CVE-2007-4771 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200803-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2008 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - iD8DBQFH1w80uhJ+ozIKI5gRAiaRAJwOh+Em/Zszc6ICpgQQ185ZrX5R9wCfcaMN 3EkI7r7NPSKsDcgXSq4CORs=EWYp -----END PGP SIGNATURE----- . Gentoo GLSA-202108-15 highlights critical security flaws in font handling systems, which could permit unauthorized remote code execution.. Gentoo Security Advisory, Unicode Issues, Remote Code Execution. . LinuxSecurity.com Team

Mar 12, 2008 Gentoo