Bug 44665 - icu: Multiple issues (4.1)
icu: Multiple issues (4.1)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.1
Other Linux
: P2 normal (vote)
: UCS 4.1-5-errata
Assigned To: Arvid Requate
Jürn Brodersen
:
Depends on: 44415
Blocks:
  Show dependency treegraph
 
Reported: 2017-05-23 14:34 CEST by Arvid Requate
Modified: 2017-12-14 13:24 CET (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score: 8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
requate: Patch_Available+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2017-05-23 14:34:20 CEST
Upstream Debian package version 4.8.1.1-12+deb7u7 fixes these issues:

* out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function (CVE-2017-7867)

* out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function (CVE-2017-7868)
Comment 1 Arvid Requate univentionstaff 2017-12-11 19:20:18 CET
Imported and built.

Advisory: https://git.knut.univention.de/univention/ucs/blob/4.1-5/doc/errata/staging/icu.yaml
Comment 3 Arvid Requate univentionstaff 2017-12-12 13:05:25 CET
Yes, the check_errata_for_release script bails out due to the extended maintenance UCS 4.1-5. I've added an ignore-tag for this to the advisory.
Comment 4 Jürn Brodersen univentionstaff 2017-12-12 13:25:24 CET
Installation: OK
YAML: OK

Verified
Comment 5 Arvid Requate univentionstaff 2017-12-14 13:24:27 CET
<http://errata.software-univention.de/ucs/4.1/487.html>