USN-2740-1: ICU vulnerabilities
16 September 2015
Several security issues were fixed in ICU.
Releases
Packages
- icu - International Components for Unicode library
Details
Atte Kettunen discovered that ICU incorrectly handled certain converter
names. If an application using ICU processed crafted data, a remote
attacker could possibly cause it to crash. (CVE-2015-1270)
It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2015-2632, CVE-2015-4760)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 15.04
Ubuntu 14.04
Ubuntu 12.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-2677-1: liboxideqtcore0, oxide-qt, liboxideqtquick0, oxideqt-codecs-extra, oxideqmlscene, oxideqt-chromedriver, oxideqt-codecs, liboxideqt-qmlplugin
- 2696-1: icedtea-7-jre-jamvm, openjdk-7-jre-zero, openjdk-7-jdk, openjdk-7, openjdk-7-jre-lib, openjdk-7-jre-headless, openjdk-7-jre
- USN-2706-1: openjdk-6, icedtea-6-jre-cacao, icedtea-6-jre-jamvm, openjdk-6-jre-zero, openjdk-6-source, openjdk-6-jre-lib, openjdk-6-jre-headless, openjdk-6-jre, openjdk-6-jdk
- USN-2696-1: icedtea-7-jre-jamvm, openjdk-7-jre-zero, openjdk-7-jdk, openjdk-7, openjdk-7-jre-lib, openjdk-7-source, openjdk-7-demo, openjdk-7-doc, openjdk-7-jre-headless, openjdk-7-jre