lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 29 Mar 2015 20:16:00 +0200
Subject: [ MDVSA-2015:161 ] icu

Hash: SHA1


 Mandriva Linux Security Advisory                         MDVSA-2015:161

 Package : icu
 Date    : March 29, 2015
 Affected: Business Server 2.0

 Problem Description:

 Updated icu packages fix security vulnerabilities:
 The Regular Expressions package in International Components for Unicode
 (ICU) 52 before SVN revision 292944 allows remote attackers to cause
 a denial of service (memory corruption) or possibly have unspecified
 other impact via vectors related to a zero-length quantifier or
 look-behind expression (CVE-2014-7923, CVE-2014-7926).
 The collator implementation in i18n/ucol.cpp in International
 Components for Unicode (ICU) 52 through SVN revision 293126 does not
 initialize memory for a data structure, which allows remote attackers
 to cause a denial of service or possibly have unspecified other impact
 via a crafted character sequence (CVE-2014-7940).
 It was discovered that ICU incorrectly handled memory operations
 when processing fonts. If an application using ICU processed crafted
 data, an attacker could cause it to crash or potentially execute
 arbitrary code with the privileges of the user invoking the program
 (CVE-2014-6585, CVE-2014-6591).


 Updated Packages:

 Mandriva Business Server 2/X86_64:
 60e38e537ccb5f492fcb51b2236cdf46  mbs2/x86_64/icu-52.1-2.1.mbs2.x86_64.rpm
 843d58cbad812ed991821b5904b965d7  mbs2/x86_64/icu-data-52.1-2.1.mbs2.noarch.rpm
 b78d857c511b2565dab1572451414a1f  mbs2/x86_64/icu-doc-52.1-2.1.mbs2.noarch.rpm
 335a5c448cbee673e993505c5f6f242f  mbs2/x86_64/lib64icu52-52.1-2.1.mbs2.x86_64.rpm
 5cc709b1ca853103c20412d9dd47f4e4  mbs2/x86_64/lib64icu-devel-52.1-2.1.mbs2.x86_64.rpm 
 8592fceada74edaee92503b81628d5ed  mbs2/SRPMS/icu-52.1-2.1.mbs2.src.rpm

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver 0x22458A98

 You can view other update advisories for Mandriva Linux at:

 If you want to report vulnerabilities, please contact


 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


Powered by blists - more mailing lists