[ MDVSA-2015:161-1 ] icu

 Mandriva Linux Security Advisory                       MDVSA-2015:161-1
 http://www.mandriva.com/en/support/security/
 ____________________________________________________________
___________

 Package : icu
 Date    : April 2, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated icu packages fix security vulnerabilities:

 The Regular Expressions package in International Components for Unicode
 (ICU) 52 before SVN revision 292944 allows remote attackers to cause
 a denial of service (memory corruption) or possibly have unspecified
 other impact via vectors related to a zero-length quantifier or
 look-behind expression (CVE-2014-7923, CVE-2014-7926).

 The collator implementation in i18n/ucol.cpp in International
 Components for Unicode (ICU) 52 through SVN revision 293126 does not
 initialize memory for a data structure, which allows remote attackers
 to cause a denial of service or possibly have unspecified other impact
 via a crafted character sequence (CVE-2014-7940).

 It was discovered that ICU incorrectly handled memory operations
 when processing fonts. If an application using ICU processed crafted
 data, an attacker could cause it to crash or potentially execute
 arbitrary code with the privileges of the user invoking the program
 (CVE-2014-6585, CVE-2014-6591).

 Update:

 Packages for Mandriva Business Server 1 are now being provided.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7923
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7926
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7940
 http://advisories.mageia.org/MGASA-2015-0047.html
 http://advisories.mageia.org/MGASA-2015-0102.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 27c2aec8b7b519e5a800d065aa2107d2  mbs1/x86_64/icu-4.8.1.1-3.2.mbs1.x86_64.rpm
 a83152f131812f4b64e05fb2a995bcce  mbs1/x86_64/icu-doc-4.8.1.1-3.2.mbs1.noarch.rpm
 704d61fb33b787020cbb99548ff90718  mbs1/x86_64/lib64icu48-4.8.1.1-3.2.mbs1.x86_64.rpm
 85c23dee675f104e7c14c713e03c0973  mbs1/x86_64/lib64icu-devel-4.8.1.1-3.2.mbs1.x86_64.rpm
 e5467efe53691c74666cefb9218f2ab8  mbs1/SRPMS/icu-4.8.1.1-3.2.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com