USN-2740-1: ICU vulnerabilities

16 September 2015

Several security issues were fixed in ICU.

Releases

Packages

  • icu - International Components for Unicode library

Details

Atte Kettunen discovered that ICU incorrectly handled certain converter
names. If an application using ICU processed crafted data, a remote
attacker could possibly cause it to crash. (CVE-2015-1270)

It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2015-2632, CVE-2015-4760)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.04
Ubuntu 14.04
Ubuntu 12.04

In general, a standard system update will make all the necessary changes.

Related notices

  • USN-2706-1: openjdk-6-jre, openjdk-6, openjdk-6-jre-lib, openjdk-6-jre-zero, openjdk-6-jre-headless, icedtea-6-jre-cacao, openjdk-6-source, icedtea-6-jre-jamvm, openjdk-6-jdk
  • USN-2677-1: oxide-qt, liboxideqtcore0
  • USN-2696-1: openjdk-7-jdk, icedtea-7-jre-jamvm, openjdk-7, openjdk-7-jre, openjdk-7-jre-zero, openjdk-7-jre-lib, openjdk-7-jre-headless
  • 2696-1: openjdk-7-jdk, icedtea-7-jre-jamvm, openjdk-7, openjdk-7-jre, openjdk-7-jre-zero, openjdk-7-jre-lib, openjdk-7-jre-headless