Articles / Debian: New icu packages co…

Debian: New icu packages correct multibyte sequence parsing

It was discovered that the ICU unicode library performed incorrect processing of invalid multibyte sequences, resulting in potential bypass of security mechanisms. Updated packages are available from security.debian.org.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1889-1                  security@debian.org
http://www.debian.org/security/                       Moritz Muehlenhoff
September 16, 2009                    http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : icu
Vulnerability  : programming error
Problem type   : local(remote)
Debian-specific: no
CVE Id(s)      : CVE-2009-0153

It was discovered that the ICU unicode library performed incorrect 
processing of invalid multibyte sequences, resulting in potential
bypass of security mechanisms.

For the old stable distribution (etch), this problem has been fixed in
version 3.6-2etch3.

For the stable distribution (lenny), this problem has been fixed in
version 3.8.1-3+lenny2.

For the unstable distribution (sid), this problem has been fixed in
version 4.0.1-1.

We recommend that you upgrade your icu packages.

Upgrade instructions
- --------------------

wget url
       will fetch the file for you
dpkg -i file.deb
       will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
       will update the internal database
apt-get upgrade
       will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

 http://security.debian.org/pool/updates/main/i/icu/icu_3.6-2etch3.dsc
   Size/MD5 checksum:      592 8b600075600533ce08c9801ffa571a19
 http://security.debian.org/pool/updates/main/i/icu/icu_3.6-2etch3.diff.gz
   Size/MD5 checksum:    45190 601af38fe10a27e08e40985c409bc6c4
 http://security.debian.org/pool/updates/main/i/icu/icu_3.6.orig.tar.gz
   Size/MD5 checksum:  9778863 0f1bda1992b4adca62da68a7ad79d830

Architecture independent packages:

 http://security.debian.org/pool/updates/main/i/icu/icu-doc_3.6-2etch3_all.deb
   Size/MD5 checksum:  3239572 8bf16fb7db375fb14de7082bcb814733

alpha architecture (DEC Alpha)

 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_alpha.deb
   Size/MD5 checksum:  5586140 1244a1b89188c020a97468dc25d22af7
 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_alpha.deb
   Size/MD5 checksum:  7012868 8680617bb8c38f6abef169b572a76baa

amd64 architecture (AMD x86_64 (AMD64))

 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_amd64.deb
   Size/MD5 checksum:  5444866 f9271ec21977880f74955cfe06b7580d
 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_amd64.deb
   Size/MD5 checksum:  6573726 25374ce8e6ae12b655a9744db65b9455

hppa architecture (HP PA RISC)

 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_hppa.deb
   Size/MD5 checksum:  5913798 20c8976b23d28d9bc91ea053748d79e0
 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_hppa.deb
   Size/MD5 checksum:  7110674 bee82145df32672bf5d61e29dd3d6bc3

i386 architecture (Intel ia32)

 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_i386.deb
   Size/MD5 checksum:  6466444 d8e1c31e6f1d238353340a9b82da1ed8
 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_i386.deb
   Size/MD5 checksum:  5470148 f5d9e50ecb224df9ae4f0c7057097f54

ia64 architecture (Intel ia64)

 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_ia64.deb
   Size/MD5 checksum:  5869036 c305e7cff86ad5584c4842fec7619fd8
 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_ia64.deb
   Size/MD5 checksum:  7243932 effc8dc2ed962de903e848ff402c167a

mips architecture (MIPS (Big Endian))

 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_mips.deb
   Size/MD5 checksum:  5747354 39624db186bbf7ce259c47681d0a1cfc
 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_mips.deb
   Size/MD5 checksum:  7052540 c159699731d592ec60fcfd4bbe010a51

mipsel architecture (MIPS (Little Endian))

 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_mipsel.deb
   Size/MD5 checksum:  6769230 32e24d0b40b3f2e62e0c2c4c4be96dce
 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_mipsel.deb
   Size/MD5 checksum:  5464426 5f544b29dd41d8326ddfd70b31e4045a

powerpc architecture (PowerPC)

 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_powerpc.deb
   Size/MD5 checksum:  6891510 af8e8b416b43a9d6c5f5893dd63261d6
 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_powerpc.deb
   Size/MD5 checksum:  5750422 ec7b53398b703da8f7e166a33768e260

s390 architecture (IBM S/390)

 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_s390.deb
   Size/MD5 checksum:  6896648 d6e3cde239924756df46b084e80388d4
 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_s390.deb
   Size/MD5 checksum:  5781028 e5c3b53fdcda2562a206d92b15a5f520

sparc architecture (Sun SPARC/UltraSPARC)

 http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_sparc.deb
   Size/MD5 checksum:  6774462 94ce55cf609a906af5336f32b6c2ee22
 http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_sparc.deb
   Size/MD5 checksum:  5673738 d63d35c169da448d83074fa45e25ed64

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

 http://security.debian.org/pool/updates/main/i/icu/icu_3.8.1-3+lenny2.diff.gz
   Size/MD5 checksum:    41943 57d76fe9884c543a634bfd44425a42c6
 http://security.debian.org/pool/updates/main/i/icu/icu_3.8.1.orig.tar.gz
   Size/MD5 checksum: 10591204 ca52a1eb5050478f5f7d24e16ce01f57
 http://security.debian.org/pool/updates/main/i/icu/icu_3.8.1-3+lenny2.dsc
   Size/MD5 checksum:     1298 e0528ce00964025af9b2f940f588664a

Architecture independent packages:

 http://security.debian.org/pool/updates/main/i/icu/icu-doc_3.8.1-3+lenny2_all.deb
   Size/MD5 checksum:  3659700 69882d02e07863b195b7e9b798bdeff2

alpha architecture (DEC Alpha)

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_alpha.deb
   Size/MD5 checksum:  6068242 7e4d26e612e178ebac27cbd2a7db72a9
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_alpha.deb
   Size/MD5 checksum:  7568600 18c17c486d3ee39d0c0b1574d219c228
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_alpha.deb
   Size/MD5 checksum:  2366836 bb1325175eb3086459d6a1daba52d010

amd64 architecture (AMD x86_64 (AMD64))

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_amd64.deb
   Size/MD5 checksum:  5932454 22e0013e161bf6ec46fdb7e330fa9c2e
 http://security.debian.org/pool/updates/main/i/icu/lib32icu38_3.8.1-3+lenny2_amd64.deb
   Size/MD5 checksum:  5919044 c785a70caa0bf88a644f0b65011915ee
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_amd64.deb
   Size/MD5 checksum:  2404096 2ce67914c39c474ff42f57ffc24bb263
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_amd64.deb
   Size/MD5 checksum:  7123322 5357c9591d7cea42b4cd9bd00b6c9114
 http://security.debian.org/pool/updates/main/i/icu/lib32icu-dev_3.8.1-3+lenny2_amd64.deb
   Size/MD5 checksum:  6063026 bde21ee163171d88d1d3b96cfa795d9b

arm architecture (ARM)

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_arm.deb
   Size/MD5 checksum:  5910002 195d7e79719dc7b6275776eb29b28b3a
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_arm.deb
   Size/MD5 checksum:  7183106 d5939d433c5e647e1c75af8fb27351d7
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_arm.deb
   Size/MD5 checksum:  2287448 c3e04dae0ad884951cc1ba6663026fed

armel architecture (ARM EABI)

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_armel.deb
   Size/MD5 checksum:  5848632 1adf442fa32cd182384d2d2608000ef8
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_armel.deb
   Size/MD5 checksum:  7420504 f593ee94d7bdb4bb8c0796aebfaccd61
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_armel.deb
   Size/MD5 checksum:  1758708 cffc60f24a4293d362d82fb6483d38fd

hppa architecture (HP PA RISC)

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_hppa.deb
   Size/MD5 checksum:  6379014 1cdb8e9a77f953d7846eb12976efb04f
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_hppa.deb
   Size/MD5 checksum:  7667266 2b4fa947ccb1c56e0a1ab997081349ad
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_hppa.deb
   Size/MD5 checksum:  2360524 012847a53a622bb3dff6a522c0521801

i386 architecture (Intel ia32)

 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_i386.deb
   Size/MD5 checksum:  2278340 b95d691813f7d32d7bc1a8aa96ddcd94
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_i386.deb
   Size/MD5 checksum:  6975168 e5c844c5ce908655075dd49c57182b3f
 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_i386.deb
   Size/MD5 checksum:  5918780 a471bd785fecadc4a7acd91be38a1bca

ia64 architecture (Intel ia64)

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_ia64.deb
   Size/MD5 checksum:  6398722 9a8fb2a23112dfa081285f2b34bc2c48
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_ia64.deb
   Size/MD5 checksum:  7828890 a56ec00c1e33f8abaaa73e211e3f26c1
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_ia64.deb
   Size/MD5 checksum:  2210326 674686adc1b87ef59144e90fdddb6e8a

mips architecture (MIPS (Big Endian))

 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_mips.deb
   Size/MD5 checksum:  6209236 3f2f1f954799ec7c20226b66578496fb
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_mips.deb
   Size/MD5 checksum:  7601662 e5873a370ba2f10e07ba438221ec9326
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_mips.deb
   Size/MD5 checksum:  2475268 9ccfeff2fbd457798ad595513c3fceb8

mipsel architecture (MIPS (Little Endian))

 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_mipsel.deb
   Size/MD5 checksum:  7294770 e7a2b87be42cf6c2eb5defc1f16fcd1b
 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_mipsel.deb
   Size/MD5 checksum:  5900392 1fd37ee3d1d15c3ad251a5b4e2707275
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_mipsel.deb
   Size/MD5 checksum:  2408066 8c5b8b9e7eb46d8404d6fbdf319ba647

powerpc architecture (PowerPC)

 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_powerpc.deb
   Size/MD5 checksum:  2378760 842531d765b7bcd25f27535f7e2195fa
 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_powerpc.deb
   Size/MD5 checksum:  7462340 0ce58e5b42bf6cea3488fc55af9b0721
 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_powerpc.deb
   Size/MD5 checksum:  6292462 d8ca2eb3b172e43405339d1ddb233b66

s390 architecture (IBM S/390)

 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_s390.deb
   Size/MD5 checksum:  7436198 33277bb42e73a64ae8421c5ce4cc390a
 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_s390.deb
   Size/MD5 checksum:  6270994 b23dd748a28ccde33d87d7df945693a2
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_s390.deb
   Size/MD5 checksum:  2471744 926e06bca83a31ce3aca813409cc95a8

sparc architecture (Sun SPARC/UltraSPARC)

 http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_sparc.deb
   Size/MD5 checksum:  7304054 9f98cb39fce383087d192faa2fc47386
 http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_sparc.deb
   Size/MD5 checksum:  2135440 3db054d567561c48e935814465e4a525
 http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_sparc.deb
   Size/MD5 checksum:  6146402 1bfc509accd39f0ca52b871b4af534a2


 These files will probably be moved into the stable distribution on
 its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkqxN9cACgkQXm3vHE4uylp6WACcDP/faUO12bVfOeG8qVHMiiRv
oKUAn0ZXj9WAkxDxgUbpM2SEG6TuoUgo
=FNYT
-----END PGP SIGNATURE-----
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.