---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: International Components for Unicode Regular Expressions Vulnerabilities SECUNIA ADVISORY ID: SA28575 VERIFY ADVISORY: http://secunia.com/advisories/28575/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: International Components for Unicode (ICU) 3.x http://secunia.com/product/17328/ DESCRIPTION: Will Drewry has reported some vulnerabilities in International Components for Unicode, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library. 1) A regular expression containing a back reference to capture group zero (\0) may reference random memory areas, which can be exploited to crash an application using the library. 2) The library does not limit the size of the backtracking stack. This can be exploited to cause a heap-based buffer overflow via certain specially crafted regular expressions. The vulnerability is reported in version 3.8.1. Other versions may also be affected. SOLUTION: Apply patch. http://source.icu-project.org/repos/icu/icu/branches/maint/maint-3-8 PROVIDED AND/OR DISCOVERED BY: Will Drewry ORIGINAL ADVISORY: http://sourceforge.net/mailarchive/message.php?msg_name=d03a2ffb0801221538x68825e42xb4a4aaf0fcccecbd%40mail.gmail.com OTHER REFERENCES: https://bugzilla.redhat.com/show_bug.cgi?id=429023 https://bugzilla.redhat.com/show_bug.cgi?id=429025 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------