USN-2740-1: ICU vulnerabilities

Releases

• Ubuntu 15.04
• Ubuntu 14.04 ESM
• Ubuntu 12.04

Packages

• icu - International Components for Unicode library

Details

Atte Kettunen discovered that ICU incorrectly handled certain converter
names. If an application using ICU processed crafted data, a remote
attacker could possibly cause it to crash. (CVE-2015-1270)

It was discovered that ICU incorrectly handled certain memory operations
when processing data. If an application using ICU processed crafted data,
a remote attacker could possibly cause it to crash or potentially execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2015-2632, CVE-2015-4760)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.04

• libicu52 - 52.1-8ubuntu0.2

Ubuntu 14.04

• libicu52 - 52.1-3ubuntu0.4

Ubuntu 12.04

• libicu48 - 4.8.1.1-3ubuntu0.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2015-1270
• CVE-2015-2632
• CVE-2015-4760

Related notices

• USN-2677-1: oxide-qt, liboxideqtquick0, liboxideqt-qmlplugin, oxideqt-codecs-extra, oxideqmlscene, oxideqt-codecs, oxideqt-chromedriver, liboxideqtcore0
• 2696-1: openjdk-7-jre-zero, openjdk-7-jre-headless, openjdk-7, openjdk-7-jdk, openjdk-7-jre, openjdk-7-jre-lib, icedtea-7-jre-jamvm
• USN-2706-1: openjdk-6-jre, openjdk-6-source, icedtea-6-jre-cacao, icedtea-6-jre-jamvm, openjdk-6-jdk, openjdk-6-jre-headless, openjdk-6-jre-lib, openjdk-6-jre-zero, openjdk-6
• USN-2696-1: openjdk-7-jre-zero, openjdk-7-jre-headless, openjdk-7-demo, openjdk-7, openjdk-7-jre-lib, openjdk-7-source, openjdk-7-jdk, openjdk-7-jre, openjdk-7-doc, icedtea-7-jre-jamvm