Bug 19315 - icu new security issue CVE-2016-6293
Summary: icu new security issue CVE-2016-6293
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/699952/
Whiteboard: MGA5-32-OK advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-09-08 20:07 CEST by David Walser
Modified: 2016-09-21 22:39 CEST (History)
2 users (show)

See Also:
Source RPM: icu-57.1-1.mga6.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2016-09-08 20:07:28 CEST 
Debian-LTS has issued an advisory today (September 8):
http://lwn.net/Alerts/699938/

Debian also has a patch for this issue for 57.1 in sid.

Mageia 5 is also affected.
David Walser 2016-09-08 20:07:38 CEST

Whiteboard: (none) => MGA5TOO

Comment 1 David Walser 2016-09-09 18:51:31 CEST 
Patched packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated icu packages fix security vulnerability:

Buffer overflow ICU in the uloc_acceptLanguageFromHTTP() function
(CVE-2016-6293).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6293
http://lwn.net/Alerts/699938/
========================

Updated packages in core/updates_testing:
========================
icu-53.1-12.4.mga5
icu53-data-53.1-12.4.mga5
icu-doc-53.1-12.4.mga5
libicu53-53.1-12.4.mga5
libicu-devel-53.1-12.4.mga5

from icu-53.1-12.4.mga5.src.rpm

Version: Cauldron => 5
Assignee: bugsquad => qa-bugs
Whiteboard: MGA5TOO => (none)

Comment 2 Dave Hodgins 2016-09-12 00:33:27 CEST 
Just testing that the update installs cleanly, and icuinfo works.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA5-32-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 3 Mageia Robot 2016-09-21 22:39:30 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0314.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.