Bug 34442 - icu new security issue CVE-2025-5222
Summary: icu new security issue CVE-2025-5222
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 34619
  Show dependency treegraph
 
Reported: 2025-07-08 15:48 CEST by Nicolas Salguero
Modified: 2025-10-28 04:05 CET (History)
4 users (show)

See Also:
Source RPM: icu-73.2-1.mga9
CVE: CVE-2025-5222
Status comment: upstream patch available


Attachments

Description Nicolas Salguero 2025-07-08 15:48:44 CEST
openSUSE has issued an advisory on July 5:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/KB5WTHV4QSRRUVG6KMSV4Z2FIQKSWR54/
Comment 1 Nicolas Salguero 2025-07-08 15:51:23 CEST
Debian has issued an advisory on June 26:
https://lists.debian.org/debian-security-announce/2025/msg00115.html

Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-5222
Source RPM: (none) => icu-76.1-2.mga10.src.rpm, icu-73.2-1.mga9.src.rpm

Comment 2 Lewis Smith 2025-07-16 21:18:25 CEST
https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77

is the patch from upstream. Unsure what version it applies to; both?
Assigning globally.

Assignee: bugsquad => pkg-bugs
Status comment: (none) => upstream patch available

katnatek 2025-07-21 18:20:32 CEST

Assignee: pkg-bugs => j.alberto.vc

Comment 3 katnatek 2025-07-21 20:31:33 CEST
(In reply to Lewis Smith from comment #2)
> https://github.com/unicode-org/icu/commit/
> 2c667e31cfd0b6bb1923627a932fd3453a5bac77
> 
> is the patch from upstream. Unsure what version it applies to; both?
> Assigning globally.

Look so, building now
Comment 4 katnatek 2025-07-22 01:39:08 CEST
RPMS;

icu-73.2-1.2.mga9
icu-doc-73.2-1.2.mga9
icu73-data-73.2-1.2.mga9
lib(64(icu-devel-73.2-1.2.mga9
lib(64)icu73-73.2-1.2.mga9

SRPM:
icu-73.2-1.2.mga9
katnatek 2025-07-22 01:40:24 CEST

Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Source RPM: icu-76.1-2.mga10.src.rpm, icu-73.2-1.mga9.src.rpm => icu-73.2-1.mga9
Assignee: j.alberto.vc => qa-bugs

Comment 5 katnatek 2025-07-22 03:17:17 CEST Comment hidden (obsolete)
Comment 6 katnatek 2025-07-22 03:19:48 CEST
Ups sorry
katnatek 2025-07-22 03:29:58 CEST

Keywords: (none) => advisory

katnatek 2025-07-22 03:39:11 CEST

Blocks: (none) => 34447

Comment 7 katnatek 2025-07-22 04:22:20 CEST
RH x86_64

installing icu73-data-73.2-1.2.mga9.noarch.rpm lib64icu73-73.2-1.2.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: icu73-data            ##################################################################################################
      2/2: lib64icu73            ##################################################################################################
      1/2: removing lib64icu73-1:73.2-1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing icu73-data-1:73.2-1.mga9.noarch
                                 ##################################################################################################

strace poedit file.po shows
openat(AT_FDCWD, "/lib64/libicui18n.so.73", O_RDONLY|O_CLOEXEC) = 3

strace guayadeque shows
openat(AT_FDCWD, "/lib64/libicuuc.so.73", O_RDONLY|O_CLOEXEC) = 3

strace aegisub shows (need check in wayland too)
openat(AT_FDCWD, "/lib64/libicuuc.so.73", O_RDONLY|O_CLOEXEC) = 3

Looks good for me
Comment 8 Herman Viaene 2025-07-22 10:46:36 CEST
MGA9-64 server Plasma Wayland on Compaq H000SB
N onstallation issues.
Ref bug 29491 for testing.
$ icuinfo
 <icuSystemParams type="icu4c">
    <param name="copyright"> Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html </param>
    <param name="product">icu4c</param>
    <param name="product.full">International Components for Unicode for C/C++</param>
    <param name="version">73.2</param>
etc....
 </icuSystemParams>


ICU Initialization returned: U_ZERO_ERROR
Plugins are disabled.

$ uconv --list
UTF-8 ibm-1208 ibm-1209 ibm-5304 ibm-5305 ibm-13496 ibm-13497 ibm-17592 ibm-17593 windows-65001 cp1208 x-UTF_8J unicode-1-1-utf-8 unicode-2-0-utf-8 
UTF-16 ISO-10646-UCS-2 ibm-1204 ibm-1205 unicode csUnicode ucs-2 
and a loooong list, ending with
ibm-16804_X110-1999,swaplfnl ibm-16804-s390 
ebcdic-xml-us 

$ uconv --default-code
UTF-8

$ uconv -f UTF-8 -t SJIS -o icu.txt createtriggerafterupdate.txt 
$ diff icu.txt createtriggerafterupdate.txt 
$ uconv -f SJIS -t ISO-8859-1 -o icuiso.txt createtriggerafterupdate.txt 
$ diff icuiso.txt createtriggerafterupdate.txt 
$ diff icu.txt icuiso.txt 
$ 
No differences found

$ cat > part2
π = 3.14159 or thereabouts
$ cat > part3
�� = 3.14159 or thereabouts
$ file part3
part3: Unicode text, UTF-8 text, with no line terminators
$ uconv -f UTF-8 -t ISO-8859-1 -o part4 part2
Conversion from Unicode to codepage failed at input byte position 0. Unicode: 03c0 Error: Invalid character found
$ od -x part2
0000000 80cf 3d20 3320 312e 3134 3935 6f20 2072
0000020 6874 7265 6165 6f62 7475 0073
0000033
$ od -x part3
0000000 bfef efbd bdbf 3d20 3320 312e 3134 3935
0000020 6f20 2072 6874 7265 6165 6f62 7475 0073
0000037
That's as far as I go, but it all seems reasonable. Tx Len

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 9 Thomas Andrews 2025-07-22 15:12:02 CEST
Validating.

CC: (none) => andrewsfarm

Comment 10 Thomas Andrews 2025-07-22 15:29:50 CEST
Really validating this time. This update will cause a rebuild of a long list of packages (See Bug 33553) so it should not be pushed until that is taken care of.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Dan Fandrich 2025-07-22 17:56:24 CEST

CC: (none) => dan
Depends on: (none) => 33553

katnatek 2025-07-26 02:01:46 CEST

Depends on: 33553 => (none)

Comment 11 katnatek 2025-07-26 02:03:27 CEST
I want to handle here the packages that need to rebuild 

List of SRPMS:
https://bugs.mageia.org/attachment.cgi?id=14663

Summary: icu new security issue CVE-2025-5222 => icu new security issue CVE-2025-5222 & packages need to be rebuild

katnatek 2025-07-26 02:09:02 CEST

Assignee: qa-bugs => pkg-bugs
Whiteboard: MGA9-64-OK => (none)
Keywords: validated_update => (none)

Comment 12 katnatek 2025-07-26 04:07:32 CEST
(In reply to katnatek from comment #11)
> I want to handle here the packages that need to rebuild 
> 
> List of SRPMS:
> https://bugs.mageia.org/attachment.cgi?id=14663

If can provide of build order please
Comment 13 katnatek 2025-07-26 04:50:16 CEST
I wonder if the mass build script could be used to this type of work?
Comment 14 katnatek 2025-07-27 22:29:29 CEST
I did try to get a build order with https://hackage.haskell.org/package/rpmbuild-order from fedora, but not likes our boost spec

 https://copr.fedorainfracloud.org/coprs/katnatek/mgaMentorship/build/9343334/
katnatek 2025-08-02 17:40:07 CEST

Blocks: 34447 => (none)

katnatek 2025-09-09 04:26:53 CEST

Depends on: (none) => 34619

katnatek 2025-09-12 22:37:51 CEST

Depends on: (none) => 33513

katnatek 2025-10-13 19:37:34 CEST

Depends on: (none) => 34665

Comment 15 katnatek 2025-10-23 19:22:53 CEST
Thomas & Dan if is fine for both can we validate & push this packages
I will keep working on the rebuild of packages still requiring icu.

So not see why not push a security update.

Assignee: pkg-bugs => qa-bugs
Depends on: 33513, 34619, 34665 => (none)

katnatek 2025-10-23 19:37:28 CEST

Summary: icu new security issue CVE-2025-5222 & packages need to be rebuild => icu new security issue CVE-2025-5222

Comment 16 Thomas Andrews 2025-10-23 20:35:06 CEST
I really don't know enough to object, or not, so I'll go along with what those who know better decide.
katnatek 2025-10-24 19:17:50 CEST

Whiteboard: (none) => MGA9-64-OK
Keywords: (none) => validated_update

katnatek 2025-10-26 23:17:47 CET

Blocks: (none) => 34619

Comment 17 Dan Fandrich 2025-10-27 17:29:42 CET
I've pushed this since it's a valid update (but I probably pushed it prematurely). However, I noticed that I still have the old, vulnerable lib64icu72 on my system, but removing it would remove over 1800 packages. It looks like when icu73 was pushed (in bug 33553) all its dependencies were not updated, meaning that icu72 and icu73 now live side-by-side in mga9. That, in turn, means that security updates to icu72 still need to be provided as well as to icu73.

Status: NEW => ASSIGNED

Comment 18 Mageia Robot 2025-10-27 17:56:09 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0249.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 19 Dan Fandrich 2025-10-27 17:59:41 CET
Reopened to handle icu72 (comment 17).

Resolution: FIXED => (none)
Status: RESOLVED => REOPENED

Comment 20 Dan Fandrich 2025-10-27 20:37:28 CET
I've discovered bug 34619 and 34665 which are to rebuild all packages depending on icu. Either that needs to be done and all those packages pushed, or icu72 should be patched. Or both; patching icu72 now then pushing those packages later.
Comment 21 katnatek 2025-10-27 21:48:18 CET
(In reply to Dan Fandrich from comment #20)
> I've discovered bug 34619 and 34665 which are to rebuild all packages
> depending on icu. Either that needs to be done and all those packages
> pushed, or icu72 should be patched. Or both; patching icu72 now then pushing
> those packages later.

I think as the first is WIP and already some QA is done the other will produce duplication of work

I'm worried about bug#33513 and bug#34672, but if not exist packages for 
samba when finish the list of stage 2 and not see intentions to fix webkit2 
when reach stage 3, I'm just make a rebuild
Comment 22 Dan Fandrich 2025-10-27 22:05:59 CET
It may be duplication of work to patch icu72, but since those rebuilds haven't been done after over 13 months, fixing the security issue now a single patch seems more prudent than waiting an indeterminate time for rebuilds.
Comment 23 katnatek 2025-10-28 01:17:20 CET
(In reply to Dan Fandrich from comment #22)
> It may be duplication of work to patch icu72, but since those rebuilds
> haven't been done after over 13 months, fixing the security issue now a
> single patch seems more prudent than waiting an indeterminate time for
> rebuilds.

Exist other problem with the idea of patch icu 72, icu 73 comes from icu srpm, so not exist icu72/icu73 separation in terms of srpm/svn , so will need to create icu72 srpm to  do that as work from icu will be rejected by the BS if we send a build for version 72

So I think we not have other choice to keep working in the rebuild of packages for icu73 even if that will delay more
Comment 24 Dan Fandrich 2025-10-28 04:05:46 CET
Ok, I'll continue the conversation in those two bugs.

Resolution: (none) => FIXED
Status: REOPENED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.