Gentoo Archives: gentoo-announce

From: Mikle Kolyada <zlogene@g.o>
To: gentoo-announce@g.o
Subject: [gentoo-announce] [ GLSA 201402-14 ] International Components for Unicode: Denial of Service
Date: Mon, 10 Feb 2014 11:13:18
Message-Id: 52F8B4E5.7040208@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201402-14
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: International Components for Unicode: Denial of Service
9 Date: February 10, 2014
10 Bugs: #460426, #486948
11 ID: 201402-14
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Two vulnerabilities in International Components for Unicode might allow
19 remote attackers to cause a Denial of Service condition.
20
21 Background
22 ==========
23
24 International Components for Unicode is a set of C/C++ and Java
25 libraries providing Unicode and Globalization support for software
26 applications.
27
28 Affected packages
29 =================
30
31 -------------------------------------------------------------------
32 Package / Vulnerable / Unaffected
33 -------------------------------------------------------------------
34 1 dev-libs/icu < 51.2-r1 >= 51.2-r1
35
36 Description
37 ===========
38
39 Multiple vulnerabilities have been discovered in International
40 Components for Unicode. Please review the CVE identifiers referenced
41 below for details.
42
43 Impact
44 ======
45
46 A remote attacker could possibly cause a Denial of Service condition.
47
48 Workaround
49 ==========
50
51 There is no known workaround at this time.
52
53 Resolution
54 ==========
55
56 All International Components for Unicode users should upgrade to the
57 latest version:
58
59 # emerge --sync
60 # emerge --ask --oneshot --verbose ">=dev-libs/icu-51.2-r1"
61
62 Packages which depend on this library may need to be recompiled. Tools
63 such as revdep-rebuild may assist in identifying some of these
64 packages.
65
66 References
67 ==========
68
69 [ 1 ] CVE-2013-0900
70 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0900
71 [ 2 ] CVE-2013-2924
72 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2924
73
74 Availability
75 ============
76
77 This GLSA and any updates to it are available for viewing at
78 the Gentoo Security Website:
79
80 http://security.gentoo.org/glsa/glsa-201402-14.xml
81
82 Concerns?
83 =========
84
85 Security is a primary focus of Gentoo Linux and ensuring the
86 confidentiality and security of our users' machines is of utmost
87 importance to us. Any security concerns should be addressed to
88 security@g.o or alternatively, you may file a bug at
89 https://bugs.gentoo.org.
90
91 License
92 =======
93
94 Copyright 2014 Gentoo Foundation, Inc; referenced text
95 belongs to its owner(s).
96
97 The contents of this document are licensed under the
98 Creative Commons - Attribution / Share Alike license.
99
100 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature