[ MDVSA-2013:258 ] icu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2013:258
http://www.mandriva.com/en/support/security/

Package : icu
Date : October 28, 2013
Affected: Business Server 1.0, Enterprise Server 5.0

Problem Description:

Updated icu packages fix security vulnerabilities:

It was discovered that ICU contained a race condition affecting
multi-threaded applications. If an application using ICU processed
crafted data, an attacker could cause it to crash or potentially
execute arbitrary code with the privileges of the user invoking the
program (CVE-2013-0900).

It was discovered that ICU incorrectly handled memory operations. If
an application using ICU processed crafted data, an attacker could
cause it to crash or potentially execute arbitrary code with the
privileges of the user invoking the program (CVE-2013-2924).

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0900
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2924
http://advisories.mageia.org/MGASA-2013-0315.html

Updated Packages:

Mandriva Enterprise Server 5:
e402bd1fc5e195fc6053b9eb96450ac2 mes5/i586/icu-4.0-2.3mdvmes5.2.i586.rpm
71c0c16cd8a71db7fe54e28177048fb6 mes5/i586/icu-doc-4.0-2.3mdvmes5.2.i586.rpm
464c3764b94b3300f281e8793a166874 mes5/i586/libicu40-4.0-2.3mdvmes5.2.i586.rpm
dbbb6da322d1ad95a8acffc512792193 mes5/i586/libicu-devel-4.0-2.3mdvmes5.2.i586.rpm
c3b7195baa3c03a38834f5d1ec66576e mes5/SRPMS/icu-4.0-2.3mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
82e865a53034461f23745446a97ee4d6 mes5/x86_64/icu-4.0-2.3mdvmes5.2.x86_64.rpm
dbaf3f82cad287a56b0576c924b18592 mes5/x86_64/icu-doc-4.0-2.3mdvmes5.2.x86_64.rpm
b0262c9b25f10d8175091bb325893b47 mes5/x86_64/lib64icu40-4.0-2.3mdvmes5.2.x86_64.rpm
40c9765f546574ab23e6c7cc4210da1f mes5/x86_64/lib64icu-devel-4.0-2.3mdvmes5.2.x86_64.rpm
c3b7195baa3c03a38834f5d1ec66576e mes5/SRPMS/icu-4.0-2.3mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
94c906297a043f53f9e05087d9483013 mbs1/x86_64/icu-4.8.1.1-3.1.mbs1.x86_64.rpm
e86894ecbe591362ba685c7ee6bb9786 mbs1/x86_64/icu-doc-4.8.1.1-3.1.mbs1.noarch.rpm
bf8f7d7147c59149813bb516fa92ff28 mbs1/x86_64/lib64icu48-4.8.1.1-3.1.mbs1.x86_64.rpm
4513ce22a7118b46e55934d5f39b4ed1 mbs1/x86_64/lib64icu-devel-4.8.1.1-3.1.mbs1.x86_64.rpm
8bf4cbf30627cf0175921779e8aa5d1c mbs1/SRPMS/icu-4.8.1.1-3.1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSbo+imqjQ0CJFipgRAn4UAKDgeXwRmECbMK8QldM9nwrsf+mcrwCffpoD
eVinIV2uSP4eIS1mdjAr/W8=
=3NcC
-----END PGP SIGNATURE-----