lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 02 Apr 2015 15:59:00 +0200
Subject: [ MDVSA-2015:161-1 ] icu

Hash: SHA1


 Mandriva Linux Security Advisory                       MDVSA-2015:161-1

 Package : icu
 Date    : April 2, 2015
 Affected: Business Server 1.0

 Problem Description:

 Updated icu packages fix security vulnerabilities:
 The Regular Expressions package in International Components for Unicode
 (ICU) 52 before SVN revision 292944 allows remote attackers to cause
 a denial of service (memory corruption) or possibly have unspecified
 other impact via vectors related to a zero-length quantifier or
 look-behind expression (CVE-2014-7923, CVE-2014-7926).
 The collator implementation in i18n/ucol.cpp in International
 Components for Unicode (ICU) 52 through SVN revision 293126 does not
 initialize memory for a data structure, which allows remote attackers
 to cause a denial of service or possibly have unspecified other impact
 via a crafted character sequence (CVE-2014-7940).
 It was discovered that ICU incorrectly handled memory operations
 when processing fonts. If an application using ICU processed crafted
 data, an attacker could cause it to crash or potentially execute
 arbitrary code with the privileges of the user invoking the program
 (CVE-2014-6585, CVE-2014-6591).


 Packages for Mandriva Business Server 1 are now being provided.


 Updated Packages:

 Mandriva Business Server 1/X86_64:
 27c2aec8b7b519e5a800d065aa2107d2  mbs1/x86_64/icu-
 a83152f131812f4b64e05fb2a995bcce  mbs1/x86_64/icu-doc-
 704d61fb33b787020cbb99548ff90718  mbs1/x86_64/lib64icu48-
 85c23dee675f104e7c14c713e03c0973  mbs1/x86_64/lib64icu-devel- 
 e5467efe53691c74666cefb9218f2ab8  mbs1/SRPMS/icu-

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver 0x22458A98

 You can view other update advisories for Mandriva Linux at:

 If you want to report vulnerabilities, please contact


 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


Powered by blists - more mailing lists