[SECURITY] [DSA 3830-1] icu security update

2017-04-1906:44:37

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

Debian Security Advisory DSA-3830-1 [email protected]
https://www.debian.org/security/ Sebastien Delafond
April 19, 2017 https://www.debian.org/security/faq

Package : icu
CVE ID : CVE-2017-7867 CVE-2017-7868
Debian Bug : 860314

It was discovered that icu, the International Components for Unicode
library, did not correctly validate its input. An attacker could use
this problem to trigger an out-of-bound write through a heap-based
buffer overflow, thus causing a denial of service via application
crash, or potential execution of arbitrary code.

For the stable distribution (jessie), these problems have been fixed in
version 52.1-8+deb8u5.

For the upcoming stable (stretch) and unstable (sid) distributions,
these problems have been fixed in version 57.1-6.

We recommend that you upgrade your icu packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8amd64libicu52< 52.1-8+deb8u5libicu52_52.1-8+deb8u5_amd64.deb
Debian8mipselicu-devtools< 52.1-8+deb8u5icu-devtools_52.1-8+deb8u5_mipsel.deb
Debian8armellibicu52< 52.1-8+deb8u5libicu52_52.1-8+deb8u5_armel.deb
Debian8mipslibicu52-dbg< 52.1-8+deb8u5libicu52-dbg_52.1-8+deb8u5_mips.deb
Debian7armellibicu-dev< 4.8.1.1-12+deb7u7libicu-dev_4.8.1.1-12+deb7u7_armel.deb
Debian8powerpclibicu-dev< 52.1-8+deb8u5libicu-dev_52.1-8+deb8u5_powerpc.deb
Debian8i386icu-devtools< 52.1-8+deb8u5icu-devtools_52.1-8+deb8u5_i386.deb
Debian8armhflibicu52< 52.1-8+deb8u5libicu52_52.1-8+deb8u5_armhf.deb
Debian8mipsellibicu52< 52.1-8+deb8u5libicu52_52.1-8+deb8u5_mipsel.deb
Debian8powerpclibicu52< 52.1-8+deb8u5libicu52_52.1-8+deb8u5_powerpc.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	libicu52	< 52.1-8+deb8u5	libicu52_52.1-8+deb8u5_amd64.deb
Debian	8	mipsel	icu-devtools	< 52.1-8+deb8u5	icu-devtools_52.1-8+deb8u5_mipsel.deb
Debian	8	armel	libicu52	< 52.1-8+deb8u5	libicu52_52.1-8+deb8u5_armel.deb
Debian	8	mips	libicu52-dbg	< 52.1-8+deb8u5	libicu52-dbg_52.1-8+deb8u5_mips.deb
Debian	7	armel	libicu-dev	< 4.8.1.1-12+deb7u7	libicu-dev_4.8.1.1-12+deb7u7_armel.deb
Debian	8	powerpc	libicu-dev	< 52.1-8+deb8u5	libicu-dev_52.1-8+deb8u5_powerpc.deb
Debian	8	i386	icu-devtools	< 52.1-8+deb8u5	icu-devtools_52.1-8+deb8u5_i386.deb
Debian	8	armhf	libicu52	< 52.1-8+deb8u5	libicu52_52.1-8+deb8u5_armhf.deb
Debian	8	mipsel	libicu52	< 52.1-8+deb8u5	libicu52_52.1-8+deb8u5_mipsel.deb
Debian	8	powerpc	libicu52	< 52.1-8+deb8u5	libicu52_52.1-8+deb8u5_powerpc.deb