-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:258 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : icu Date : October 28, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Updated icu packages fix security vulnerabilities: It was discovered that ICU contained a race condition affecting multi-threaded applications. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program (CVE-2013-0900). It was discovered that ICU incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program (CVE-2013-2924). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0900 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2924 http://advisories.mageia.org/MGASA-2013-0315.html _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: e402bd1fc5e195fc6053b9eb96450ac2 mes5/i586/icu-4.0-2.3mdvmes5.2.i586.rpm 71c0c16cd8a71db7fe54e28177048fb6 mes5/i586/icu-doc-4.0-2.3mdvmes5.2.i586.rpm 464c3764b94b3300f281e8793a166874 mes5/i586/libicu40-4.0-2.3mdvmes5.2.i586.rpm dbbb6da322d1ad95a8acffc512792193 mes5/i586/libicu-devel-4.0-2.3mdvmes5.2.i586.rpm c3b7195baa3c03a38834f5d1ec66576e mes5/SRPMS/icu-4.0-2.3mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 82e865a53034461f23745446a97ee4d6 mes5/x86_64/icu-4.0-2.3mdvmes5.2.x86_64.rpm dbaf3f82cad287a56b0576c924b18592 mes5/x86_64/icu-doc-4.0-2.3mdvmes5.2.x86_64.rpm b0262c9b25f10d8175091bb325893b47 mes5/x86_64/lib64icu40-4.0-2.3mdvmes5.2.x86_64.rpm 40c9765f546574ab23e6c7cc4210da1f mes5/x86_64/lib64icu-devel-4.0-2.3mdvmes5.2.x86_64.rpm c3b7195baa3c03a38834f5d1ec66576e mes5/SRPMS/icu-4.0-2.3mdvmes5.2.src.rpm Mandriva Business Server 1/X86_64: 94c906297a043f53f9e05087d9483013 mbs1/x86_64/icu-4.8.1.1-3.1.mbs1.x86_64.rpm e86894ecbe591362ba685c7ee6bb9786 mbs1/x86_64/icu-doc-4.8.1.1-3.1.mbs1.noarch.rpm bf8f7d7147c59149813bb516fa92ff28 mbs1/x86_64/lib64icu48-4.8.1.1-3.1.mbs1.x86_64.rpm 4513ce22a7118b46e55934d5f39b4ed1 mbs1/x86_64/lib64icu-devel-4.8.1.1-3.1.mbs1.x86_64.rpm 8bf4cbf30627cf0175921779e8aa5d1c mbs1/SRPMS/icu-4.8.1.1-3.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFSbo+imqjQ0CJFipgRAn4UAKDgeXwRmECbMK8QldM9nwrsf+mcrwCffpoD eVinIV2uSP4eIS1mdjAr/W8= =3NcC -----END PGP SIGNATURE-----