Bug 51040

Summary:	icu: Multiple issues (4.3)
Product:	UCS	Reporter:	Quality Assurance <qa>
Component:	Security updates	Assignee:	Quality Assurance <qa>
Status:	CLOSED FIXED	QA Contact:	Erik Damrose <damrose>
Severity:	normal
Priority:	P3
Version:	UCS 4.3
Target Milestone:	UCS 4.3-5-errata
Hardware:	All
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Description Quality Assurance

2020-03-30 10:43:32 CEST

New Debian icu 57.1-6+deb9u4 fixes:
This update addresses the following issue:

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.

* 57.1-6+deb9u3 (Wed, 07 Aug 2019 16:30:43 +0000) * Fix pkgdata command  segfault.
* Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

Comment 1 Quality Assurance

2020-03-31 20:00:07 CEST

--- mirror/ftp/4.3/unmaintained/4.3-5/source/icu_57.1-6+deb9u3.dsc
+++ apt/ucs_4.3-0-errata4.3-5/source/icu_57.1-6+deb9u4.dsc
@@ -1,3 +1,8 @@
+57.1-6+deb9u4 [Sat, 14 Mar 2020 19:34:22 +0000] Laszlo Boszormenyi (GCS) <gcs@debian.org>:
+
+  * Backport upstream security fix for CVE-2020-10531: SEGV_MAPERR in
+    UnicodeString::doAppend() (closes: #953747).
+
 57.1-6+deb9u3 [Wed, 07 Aug 2019 16:30:43 +0000] Laszlo Boszormenyi (GCS) <gcs@debian.org>:
 
   * Fix pkgdata command segfault (closes: #893009).

<http://10.200.17.11/4.3-5/#4148741556317664766>

Comment 2 Erik Damrose

2020-04-01 11:47:13 CEST

OK: piuparts
OK: debdiff, dchdiff, dscdiff
OK: ~yaml; jenkinsjob failed to create the yaml properly, fixed now
OK: no patch required
Verified

Comment 3 Erik Damrose

2020-04-02 15:09:04 CEST

<http://errata.software-univention.de/ucs/4.3/663.html>