Bug 19315

Summary:	icu new security issue CVE-2016-6293
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, sysadmin-bugs
Version:	5	Keywords:	validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/699952/
Whiteboard:	MGA5-32-OK advisory
Source RPM:	icu-57.1-1.mga6.src.rpm	CVE:
Status comment:

Description David Walser 2016-09-08 20:07:28 CEST

Debian-LTS has issued an advisory today (September 8):
http://lwn.net/Alerts/699938/

Debian also has a patch for this issue for 57.1 in sid.

Mageia 5 is also affected.

David Walser 2016-09-08 20:07:38 CEST

Whiteboard: (none) => MGA5TOO

Comment 1 David Walser 2016-09-09 18:51:31 CEST

Patched packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated icu packages fix security vulnerability:

Buffer overflow ICU in the uloc_acceptLanguageFromHTTP() function
(CVE-2016-6293).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6293
http://lwn.net/Alerts/699938/
========================

Updated packages in core/updates_testing:
========================
icu-53.1-12.4.mga5
icu53-data-53.1-12.4.mga5
icu-doc-53.1-12.4.mga5
libicu53-53.1-12.4.mga5
libicu-devel-53.1-12.4.mga5

from icu-53.1-12.4.mga5.src.rpm

Version: Cauldron => 5
Assignee: bugsquad => qa-bugs
Whiteboard: MGA5TOO => (none)

Comment 2 Dave Hodgins 2016-09-12 00:33:27 CEST

Just testing that the update installs cleanly, and icuinfo works.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA5-32-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 3 Mageia Robot 2016-09-21 22:39:30 CEST

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0314.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED