[ MDVSA-2015:161 ] icu

Mandriva Linux Security Advisory                         MDVSA-2015:161
 http://www.mandriva.com/en/support/security/
 ____________________________________________________________
___________

 Package : icu
 Date    : March 29, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated icu packages fix security vulnerabilities:

 The Regular Expressions package in International Components for Unicode
 (ICU) 52 before SVN revision 292944 allows remote attackers to cause
 a denial of service (memory corruption) or possibly have unspecified
 other impact via vectors related to a zero-length quantifier or
 look-behind expression (CVE-2014-7923, CVE-2014-7926).

 The collator implementation in i18n/ucol.cpp in International
 Components for Unicode (ICU) 52 through SVN revision 293126 does not
 initialize memory for a data structure, which allows remote attackers
 to cause a denial of service or possibly have unspecified other impact
 via a crafted character sequence (CVE-2014-7940).


 It was discovered that ICU incorrectly handled memory operations
 when processing fonts. If an application using ICU processed crafted
 data, an attacker could cause it to crash or potentially execute
 arbitrary code with the privileges of the user invoking the program
 (CVE-2014-6585, CVE-2014-6591).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7923
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7926
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7940
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591
 http://advisories.mageia.org/MGASA-2015-0047.html
 http://advisories.mageia.org/MGASA-2015-0102.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 2/X86_64:
 60e38e537ccb5f492fcb51b2236cdf46  mbs2/x86_64/icu-52.1-2.1.mbs2.x86_64.rpm
 843d58cbad812ed991821b5904b965d7  mbs2/x86_64/icu-data-52.1-2.1.mbs2.noarch.rpm
 b78d857c511b2565dab1572451414a1f  mbs2/x86_64/icu-doc-52.1-2.1.mbs2.noarch.rpm
 335a5c448cbee673e993505c5f6f242f  mbs2/x86_64/lib64icu52-52.1-2.1.mbs2.x86_64.rpm
 5cc709b1ca853103c20412d9dd47f4e4  mbs2/x86_64/lib64icu-devel-52.1-2.1.mbs2.x86_64.rpm
 8592fceada74edaee92503b81628d5ed  mbs2/SRPMS/icu-52.1-2.1.mbs2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com