Home / mailings

PDF

[USN-1989-1] ICU vulnerabilities

Posted on 15 October 2013
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-1989-1
October 15, 2013

icu vulnerabilities
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

ICU could be made to crash or run programs as your login if it processed
specially crafted data.

Software Description:
- icu: International Components for Unicode library

Details:

It was discovered that ICU contained a race condition affecting multi-
threaded applications. If an application using ICU processed crafted data=
,
an attacker could cause it to crash or potentially execute arbitrary code=

with the privileges of the user invoking the program. This issue only
affected Ubuntu 12.04 LTS and Ubuntu 12.10. (CVE-2013-0900)

It was discovered that ICU incorrectly handled memory operations. If an
application using ICU processed crafted data, an attacker could cause it =
to
crash or potentially execute arbitrary code with the privileges of the us=
er
invoking the program. (CVE-2013-2924)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libicu48 4.8.1.1-12ubuntu0.1

Ubuntu 12.10:
libicu48 4.8.1.1-8ubuntu0.1

Ubuntu 12.04 LTS:
libicu48 4.8.1.1-3ubuntu0.1

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-1989-1
CVE-2013-0900, CVE-2013-2924

Package Information:
https://launchpad.net/ubuntu/+source/icu/4.8.1.1-12ubuntu0.1
https://launchpad.net/ubuntu/+source/icu/4.8.1.1-8ubuntu0.1
https://launchpad.net/ubuntu/+source/icu/4.8.1.1-3ubuntu0.1

 

TOP