Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

The remote Solaris system is missing necessary patches to address security updates :

  - The International Components for Unicode (ICU)     functionality in Google Chrome before 13.0.782.107     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors that trigger an out-of-bounds write.
    (CVE-2011-2791)

  - Stack-based buffer overflow in the _canonicalize     function in common/uloc.c in International Components     for Unicode (ICU) before 49.1 allows remote attackers to     execute arbitrary code via a crafted locale ID that is     not properly handled during variant canonicalization.
    (CVE-2011-4599)

Specially crafted strings could cause a buffer overflow in icu (CVE-2011-4599).

An integer overflow in the getSymbol() function could crash applications using icu (CVE-2010-4409)

A stack-based buffer overflow flaw was found in the way ICU performed variant canonicalization for some locale identifiers. If a specially crafted locale representation was opened in an application linked against ICU, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-4599)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1815 advisory.

    [4.2.1-9.1]
    - Resolves: rhbz#766539 CVE-2011-4599 localeID overflow

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update is rereleased because some architectures were missed on the first try. It fixes the following security issues :

  - Specially crafted strings could cause a buffer overflow     in icu. (CVE-2011-4599)

  - An integer overflow in the getSymbol() function could     crash applications using icu (CVE-2010-4409)

According to its banner, the remote Apple TV 2nd generation or later device has a version of iOS that is prior to 5.1. It is, therefore, reportedly affected by several vulnerabilities :

  - An uninitialized memory access issue in the handling of     Sorenson encoded movie files could lead to arbitrary     code execution. (CVE-2012-3722)

  - Following the DNAv4 protocol, the device may broadcast     MAC addresses of previously accessed networks when     connecting to a Wi-Fi network. (CVE-2012-3725)

  - A buffer overflow in libtiff's handling of ThunderScan     encoded TIFF images could lead to arbitrary code     execution. (CVE-2011-1167)

  - Multiple memory corruption issues in libpng's handling     of PNG images could lead to arbitrary code execution.
    (CVE-2011-3026 / CVE-2011-3048 / CVE-2011-3328)

  - A double free issue in ImageIO's handling of JPEG     images could lead to arbitrary code execution.
    (CVE-2012-3726)

  - An integer overflow issue in libTIFF's handling of TIFF     images could lead to arbitrary code execution.
    (CVE-2012-1173)

  - A stack-based buffer overflow in the handling of ICU     locale IDs could lead to arbitrary code execution.
    (CVE-2011-4599)

  - Multiple vulnerabilities in libxml could have a variety     of impacts, including arbitrary code execution.
    (CVE-2011-1944 / CVE-2011-2821 / CVE-2011-2834 /     CVE-2011-3919)

  - Multiple memory corruption issues in JavaScriptCore     could lead to arbitrary code execution.
    (CVE-2012-0682 / CVE-2012-0683 / CVE-2012-3589 /     CVE-2012-3590 / CVE-2012-3591 / CVE-2012-3592 /     CVE-2012-3678 / CVE-2012-3679)

The remote host is affected by the vulnerability described in GLSA-201209-07 (International Components for Unicode: User-assisted execution of arbitrary code)

    An error in the _canonicalize() function in uloc.cpp could cause a       stack-based buffer overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted locale       representation using an application linked against ICU, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS prior to 6.0 are exposed to the following vulnerabilities :

  - Numerous memory errors exist related to handling 'TIFF', 'PNG' and 'JPEG' images and 'ImageIO' that can allow arbitrary code execution. (CVE-2011-1167, CVE-2011-3026, CVE-2011-3048, CVE-2011-3328, CVE-2012-1173, CVE-2012-3726)

  - Several issues exist related to 'CoreGraphics' and 'FreeType' (CVE-2012-1126, CVE-2012-1127, CVE-2012-1128, CVE-2012-1129, CVE-2012-1130, CVE-2012-1131, CVE-2012-1132, CVE-2012-1133, CVE-2012-1134, CVE-2012-1135, CVE-2012-1136, CVE-2012-1137, CVE-2012-1138, CVE-2012-1139, CVE-2012-1140, CVE-2012-1141, CVE-2012-1142, CVE-2012-1143, CVE-2012-1144)

  - Numerous issues exist related to libxml and can lead to application crashes or arbitrary code execution. (CVE-2011-1944, CVE-2011-2821, CVE-2011-2834, CVE-2011-3919)

  - A stack-based buffer overflow exists related to 'locale ID' and 'International Components for Unicode' (ICU). (CVE-2011-4599)

  - An unitialized memory access issue exists related to 'Sorenson' encoded movie files and 'CoreMedia'. (CVE-2012-3722)

  - An URL handling issue exists related to 'CFNetwork' that can disclose sensitive information. (CVE-2012-3724)

  - The 'DNAv4' protocol discloses sensitive information when connecting to unencrypted Wi-Fi networks. (CVE-2012-3725)

  - A buffer overflow error exists related to 'IPSec' and 'racoon' configuration files. (CVE-2012-3727)

  - An invalid pointer dereference error exists related to the kernel and packet filter ioctls. (CVE-2012-3728)

  - An uninitialized memory access error exists related to the kernel and the Berkeley Packet Filter interpreter. (CVE-2012-3729)

  - Several issues exist related to 'Mail' and the handling of attachments and 'S/MIME' signed messages. (CVE-2012-3730, CVE-2012-3731, CVE-2012-3732)

  - Information disclosure issues exist related to 'Messages', 'Office Viewer', system logs, and 'UIKit'. (CVE-2012-3733, CVE-2012-3734, CVE-2012-3743, CVE-2012-3746)

  - Memory corruption errors exist related to 'OpenGL'. (CVE-2011-3457)

  - Numerous errors exist related to 'Passcode Lock'. (CVE-2012-3735, CVE-2012-3736, CVE-2012-3737, CVE-2012-3738, CVE-2012-3739, CVE-2012-3740)

  - An error exists in 'Restrictions' that can allow unauthorized purchases. (CVE-2012-3741)

  - Errors exist in 'Safari' that are related to misleading URL characters and password auto complete. (CVE-2012-3742, CVE-2012-0680)

  - A buffer overflow error exists related to 'Telephony' and SMS handling. (CVE-2012-3745)

  - Many errors exist related to the bundled 'WebKit' components. (CVE-2011-2845, CVE-2011-3016, CVE-2011-3021, CVE-2011-3027, CVE-2011-3032, CVE-2011-3034, CVE-2011-3035, CVE-2011-3036, CVE-2011-3037, CVE-2011-3038, CVE-2011-3039, CVE-2011-3040, CVE-2011-3041, CVE-2011-3042, CVE-2011-3043, CVE-2011-3044, CVE-2011-3050, CVE-2011-3053, CVE-2011-3059, CVE-2011-3060, CVE-2011-3064, CVE-2011-3067, CVE-2011-3068, CVE-2011-3069, CVE-2011-3071, CVE-2011-3073, CVE-2011-3074, CVE-2011-3075, CVE-2011-3076, CVE-2011-3078, CVE-2011-3081, CVE-2011-3086, CVE-2011-3089, CVE-2011-3090, CVE-2011-3105, CVE-2011-3913, CVE-2011-3924, CVE-2011-3926, CVE-2011-3958, CVE-2011-3966, CVE-2011-3968, CVE-2011-3969, CVE-2011-3971, CVE-2012-0682, CVE-2012-0683, CVE-2012-1520, CVE-2012-1521, CVE-2012-2815, CVE-2012-2818, CVE-2012-3589, CVE-2012-3590, CVE-2012-3591, CVE-2012-3592, CVE-2012-3593, CVE-2012-3594, CVE-2012-3595, CVE-2012-3596, CVE-2012-3597, CVE-2012-3598, CVE-2012-3599, CVE-2012-3600, CVE-2012-3601, CVE-2012-3602, CVE-2012-3603, CVE-2012-3604, CVE-2012-3605, CVE-2012-3608, CVE-2012-3609, CVE-2012-3610, CVE-2012-3611, CVE-2012-3612, CVE-2012-3613, CVE-2012-3614, CVE-2012-3615, CVE-2012-3617, CVE-2012-3618, CVE-2012-3620, CVE-2012-3624, CVE-2012-3625, CVE-2012-3626, CVE-2012-3627, CVE-2012-3628, CVE-2012-3629, CVE-2012-3630, CVE-2012-3631, CVE-2012-3633, CVE-2012-3634, CVE-2012-3635, CVE-2012-3636, CVE-2012-3637, CVE-2012-3638, CVE-2012-3639, CVE-2012-3640, CVE-2012-3641, CVE-2012-3642, CVE-2012-3644, CVE-2012-3645, CVE-2012-3646, CVE-2012-3647, CVE-2012-3648, CVE-2012-3650, CVE-2012-3651, CVE-2012-3652, CVE-2012-3653, CVE-2012-3655, CVE-2012-3656, CVE-2012-3658, CVE-2012-3659, CVE-2012-3660, CVE-2012-3661, CVE-2012-3663, CVE-2012-3664, CVE-2012-3665, CVE-2012-3666, CVE-2012-3667, CVE-2012-3668, CVE-2012-3669, CVE-2012-3670, CVE-2012-3671, CVE-2012-3672, CVE-2012-3673, CVE-2012-3674, CVE-2012-3676, CVE-2012-3677, CVE-2012-3678, CVE-2012-3679, CVE-2012-3680, CVE-2012-3681, CVE-2012-3682, CVE-2012-3683, CVE-2012-3684, CVE-2012-3686, CVE-2012-3691, CVE-2012-3693, CVE-2012-3695, CVE-2012-3696, CVE-2012-3703, CVE-2012-3704, CVE-2012-3706, CVE-2012-3708, CVE-2012-3710, CVE-2012-3747)

The mobile device is running a version of iOS that is older than version 6.0.  Version 6.0 contains numerous security-related fixes for the following vulnerabilities :

  - Numerous memory errors exist related to handling     'TIFF', 'PNG' and 'JPEG' images and 'ImageIO' that could     allow arbitrary code execution. (CVE-2011-1167,     CVE-2011-3026, CVE-2011-3048, CVE-2011-3328,     CVE-2012-1173, CVE-2012-3726)

  - Several issues exist related to 'CoreGraphics' and     'FreeType' (CVE-2012-1126, CVE-2012-1127, CVE-2012-1128,     CVE-2012-1129, CVE-2012-1130, CVE-2012-1131,     CVE-2012-1132, CVE-2012-1133, CVE-2012-1134,     CVE-2012-1135, CVE-2012-1136, CVE-2012-1137,     CVE-2012-1138, CVE-2012-1139, CVE-2012-1140,     CVE-2012-1141, CVE-2012-1142, CVE-2012-1143,     CVE-2012-1144)

  - Numerous issues exist related to libxml and could lead     to application crashes or arbitrary code execution.
    (CVE-2011-1944, CVE-2011-2821, CVE-2011-2834,     CVE-2011-3919)

  - A stack-based buffer overflow exists related to 'locale     ID' and 'International Components for Unicode' (ICU).
    (CVE-2011-4599)

  - An unitialized memory access issue exists related to     'Sorenson' encoded movie files and 'CoreMedia'.
    (CVE-2012-3722)

  - An URL handling issue exists related to 'CFNetwork'     that can disclose sensitive information. (CVE-2012-3724)

  - The 'DNAv4' protocol discloses sensitive information     when connecting to unencrypted WiFi networks.
    (CVE-2012-3725)

  - A buffer overflow error exists related to 'IPSec' and     'racoon' configuration files. (CVE-2012-3727)

  - An invalid pointer dereference error exists related to     the kernel and packet filter ioctls. (CVE-2012-3728)

  - An uninitialized memory access error exists related to     the kernel and the Berkeley Packet Filter interpreter.
    (CVE-2012-3729)

  - Several issues exist related to 'Mail' and the handling     of attachments and 'S/MIME' signed messages.
    (CVE-2012-3730, CVE-2012-3731, CVE-2012-3732)

  - Information disclosure issues exist related to     'Messages', 'Office Viewer', system logs, and 'UIKit'.
    (CVE-2012-3733, CVE-2012-3734, CVE-2012-3743,     CVE-2012-3746)

  - Memory corruption errors exist related to 'OpenGL'.
    (CVE-2011-3457)

  - Numerous errors exist related to 'Passcode Lock'.
    (CVE-2012-3735, CVE-2012-3736, CVE-2012-3737,     CVE-2012-3738, CVE-2012-3739, CVE-2012-3740)

  - An error exists in 'Restrictions' that could allow     unauthorized purchases. (CVE-2012-3741)

  - Errors exist in 'Safari' that are related to misleading     URL characters and password auto complete.
    (CVE-2012-3742, CVE-2012-0680)

  - A buffer overflow error exists related to 'Telephony'     and SMS handling. (CVE-2012-3745)

  - Many errors exist related to the bundled 'WebKit'     components. (CVE-2011-2845, CVE-2011-3016,     CVE-2011-3021, CVE-2011-3027, CVE-2011-3032,     CVE-2011-3034, CVE-2011-3035, CVE-2011-3036,     CVE-2011-3037, CVE-2011-3038, CVE-2011-3039,     CVE-2011-3040, CVE-2011-3041, CVE-2011-3042,     CVE-2011-3043, CVE-2011-3044, CVE-2011-3050,     CVE-2011-3053, CVE-2011-3059, CVE-2011-3060,     CVE-2011-3064, CVE-2011-3067, CVE-2011-3068,     CVE-2011-3069, CVE-2011-3071, CVE-2011-3073,     CVE-2011-3074, CVE-2011-3075, CVE-2011-3076,     CVE-2011-3078, CVE-2011-3081, CVE-2011-3086,     CVE-2011-3089, CVE-2011-3090, CVE-2011-3105,     CVE-2011-3913, CVE-2011-3924, CVE-2011-3926,     CVE-2011-3958, CVE-2011-3966, CVE-2011-3968,     CVE-2011-3969, CVE-2011-3971, CVE-2012-0682,     CVE-2012-0683, CVE-2012-1520, CVE-2012-1521,     CVE-2012-2815, CVE-2012-2818, CVE-2012-3589,     CVE-2012-3590, CVE-2012-3591, CVE-2012-3592,     CVE-2012-3593, CVE-2012-3594, CVE-2012-3595,     CVE-2012-3596, CVE-2012-3597, CVE-2012-3598,     CVE-2012-3599, CVE-2012-3600, CVE-2012-3601,     CVE-2012-3602, CVE-2012-3603, CVE-2012-3604,     CVE-2012-3605, CVE-2012-3608, CVE-2012-3609,     CVE-2012-3610, CVE-2012-3611, CVE-2012-3612,     CVE-2012-3613, CVE-2012-3614, CVE-2012-3615,     CVE-2012-3617, CVE-2012-3618, CVE-2012-3620,     CVE-2012-3624, CVE-2012-3625, CVE-2012-3626,     CVE-2012-3627, CVE-2012-3628, CVE-2012-3629,     CVE-2012-3630, CVE-2012-3631, CVE-2012-3633,     CVE-2012-3634, CVE-2012-3635, CVE-2012-3636,     CVE-2012-3637, CVE-2012-3638, CVE-2012-3639,     CVE-2012-3640, CVE-2012-3641, CVE-2012-3642,     CVE-2012-3644, CVE-2012-3645, CVE-2012-3646,     CVE-2012-3647, CVE-2012-3648, CVE-2012-3650,     CVE-2012-3651, CVE-2012-3652, CVE-2012-3653,     CVE-2012-3655, CVE-2012-3656, CVE-2012-3658,     CVE-2012-3659, CVE-2012-3660, CVE-2012-3661,     CVE-2012-3663, CVE-2012-3664, CVE-2012-3665,     CVE-2012-3666, CVE-2012-3667, CVE-2012-3668,     CVE-2012-3669, CVE-2012-3670, CVE-2012-3671,     CVE-2012-3672, CVE-2012-3673, CVE-2012-3674,     CVE-2012-3676, CVE-2012-3677, CVE-2012-3678,     CVE-2012-3679, CVE-2012-3680, CVE-2012-3681,     CVE-2012-3682, CVE-2012-3683, CVE-2012-3684,     CVE-2012-3686, CVE-2012-3691, CVE-2012-3693,     CVE-2012-3695, CVE-2012-3696, CVE-2012-3703,     CVE-2012-3704, CVE-2012-3706, CVE-2012-3708,     CVE-2012-3710, CVE-2012-3747)

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.5.  The newer version contains numerous security-related fixes for the following components :

  - Apache

  - BIND

  - CoreText

  - Data Security

  - ImageIO

  - Installer

  - International Components for Unicode

  - Kernel

  - Mail

  - PHP

  - Profile Manager

  - QuickLook

  - QuickTime

  - Ruby

  - USB

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components :

  - Apache
  - Data Security
  - DirectoryService
  - ImageIO
  - International Components for Unicode
  - Mail
  - PHP
  - QuickLook
  - QuickTime
  - Ruby

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A stack-based buffer overflow flaw was found in the way ICU performed variant canonicalization for some locale identifiers. If a specially crafted locale representation was opened in an application linked against ICU, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-4599)

All users of ICU should upgrade to these updated packages, which contain a backported patch to resolve this issue. All applications linked against ICU must be restarted for this update to take effect.

LibreOffice 3.4.5 includes many fixes over the previous LibreOffice 3.4.2.6 update.

The update fixes the following security issues :

  - 740453: Vulnerability in RDF handling. (CVE-2012-0037)

  - 752595: overflow in jpeg handling. (CVE-2012-1149)

  - 736146: buffer overflow in the build in icu copy     (736146) This update also fixes the following     non-security issues :

Extras :

  - add SUSE color palette (fate#312645) Filters :

  - crash when loading embedded elements. (bnc#693238)

  - crash when importing an empty paragraph (rh#667082)

  - more on bentConnectors. (bnc#736495)

  - wrong text color in smartArt. (bnc#746996)

  - reading of w:textbox contents. (bnc#693388)

  - textbox position and size DOCX import (fdo#45560)

  - RTF/DOCX import of transparent frames. (bnc#695479)

  - consecutive frames in RTF/DOCX import. (bnc#703032)

  - handling of frame properties in RTF import. (bnc#417818)

  - force imported XLSX active tab to be shown. (bnc#748198)

  - create TableManager for inside shapes. (bnc#747471,     bnc#693238)

  - textboxes import with OLE objects inside. (bnc#747471,     bnc#693238)

  - table style. (bnc#705991)

  - text rotation fixes. (bnc#734734)

  - crash in PPTX import. (bnc#706792)

  - read w:sdt* contents. (bnc#705949)

  - connector shape fixes. (bnc#719989)

  - legacy fragment import. (bnc#699334)

  - non-working Excel macros. (bnc#705977)

  - free drawn curves import. (bnc#657909)

  - group shape transformations. (bnc#621739)

  - extLst of drawings in diagrams import. (bnc#655408)

  - flip properties of custom shapes import. (bnc#705985)

  - line spacing is used from previous values. (bnc#734734)

  - missing ooxml customshape->mso shape name entries.
    (bnc#737921)

  - word doesn't break the numberings and prefers hiding     them. (bnc#707157)

Base :

  - iterator misuse (fdo #44040, bnc#742178) Writer :

  - do not use an invalidated iterator (fdo#46337)

  - field refreshing (fdo#39694)

  - more layout crashers (i#101776, fdo#39510)

  - textbox borders style and width in DOCX import     (fdo#45560)

  - expand all text fields when setting properties     (fdo#42073)

  - version 3.4.5.3, tag suse-3.4.5.3 (SUSE LO 3.4.5-rc1)

  - SmartArt import

  - custom shapes import

  - Oracle Java 1.7.0 detection

  - reading AES-encrypted ODF 1.2 documents as generated by     LO 3.5

  - frame selection. (bnc#740117)

  - crash when editing index. (bnc#726174)

  - order database properties. (bnc#740032)

  - numbering levels in DOC import. (bnc#715115)

  - image size issue in DOC import. (bnc#718971)

  - pointless forward moving of a table. (bnc#706138)

  - tabs set after the end margin in DOCX import.
    (bnc#693238)

  - add hyperlinks by default in Table of Contents     (bnc#705956) Calc :

  - pie charts colors messed in XLS import (fdo#40320)

  - correctly import data point formats in data series     (fdo#40320) Components :

  - crash when parsing XML signatures (fdo#39657)

  - broken getDataArray (fdo#46165, fdo#38441, i#117010)

  - don't paint a frame around the list of edit boxes     (fdo#42543)

  - inconsistent compression method for encrypted documents.
    (bnc#653688)

  - allow pasting to multiple ranges. (bnc#715094)

  - correctly convert chart data ranges. (bnc#727504)

  - definedName corruption for XLSX export. (bnc#741182)

  - adjust/shrink the ranges while copying. (bnc#677811)

  - extra graph data is displayed for label. (bnc#717290)

  - getCellRangeByName failure for named range. (bnc#738113)

  - graph in XLS file has dates displayed wrong.
    (bnc#720443)

  - improve performance of large Excel documents.
    (bnc#715104)

  - display page background color/image properly.
    (bnc#722045)

  - pivot table output becoming empty on re-save.
    (bnc#715543)

  - encode virtual paths to local volume correctly.
    (bnc#719887)

  - avoid adjusting cell-anchored objects on other sheets.
    (bnc#726152)

  - make sure to adjust the sheet index of drawing objects.
    (bnc#733864)

  - make the data validation popup more reliable (fdo     #36851, bnc#737190) Impress :

  - do not create an empty slide when printing handouts     (fdo#31966)

  - undo corruption. (bnc#685123)

  - do not set duplicate master slide names (bnc#735533)     Libraries :

  - default shortcut for .uno:SearchDialog should be Ctrl+H

  - crash using instances dialog of dataform navigator     (fdo#44816)

  - disable problematic reading of external entities in     raptor

  - correctly calculate leap year

  - use proper Indian Rupee currency symbol U+20B9     (rh#794679)

  - handle copy and paste from ConsoleOne. (bnc#704274)

  - VBA control events not working, broken eventattacher.
    (bnc#718227)

  - 'General Error' when double-click graphic in     presentation. (bnc#720948)

  - upgrade graphite to 1.0.3 fix surrogate support

  - crash at exit. (bnc#728603)

  - radial gradient offset. (bnc#714787)

  - horizontal scrollbars with KDE oxygen style.
    (bnc#722918)

  - rendering of metafiles embedded in EMF+ (updated)     (bnc#705956) Postprocess :

  - make the 3D transitions work again (bnc#728559) URE :

  - make Duden Korrektor 5 and 6 work General :

  - add compat symlinks for the old main desktop icon.
    (bnc#724087)

  - Fix tooltips are all black in KDE4 (bnc#723074,     fdo#40461)

  - do-not-display-math-in-desktop-menu.diff: do not display     math in desktop menu (fdo#41681)

  - desktop-submenu.diff: display LO application in the     right desktop submenu. (bnc#718694)

  - bash-completion-for-loffice.diff: define bash completion     for 'loffice' wrapper. (bnc#719656)

  - svx-globlmn-hrc-build-dep.diff: fix build dependency     problem in svx

It was discovered that a buffer overflow in the Unicode library ICU could lead to the execution of arbitrary code.

It was discovered that ICU did not properly handle invalid locale data during Unicode conversion. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following bugs have been fixed :

  - Specially crafted strings could cause a buffer overflow     in icu. (CVE-2011-4599)

  - An integer overflow in the getSymbol() function could     crash applications using icu (CVE-2010-4409)

A vulnerability has been discovered and corrected in icu :

A stack-based buffer overflow flaw was found in the way ICU performed variant canonicalization for some locale identifiers. If a specially crafted locale representation was opened in an application linked against ICU, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2011-4599).

The updated packages have been patched to correct this issue.

Fixes CVE-2011-4599

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated icu packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A stack-based buffer overflow flaw was found in the way ICU performed variant canonicalization for some locale identifiers. If a specially crafted locale representation was opened in an application linked against ICU, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-4599)

All users of ICU should upgrade to these updated packages, which contain a backported patch to resolve this issue. All applications linked against ICU must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
80641	Oracle Solaris Third-Party Patch Update : icu (multiple_vulnerabilities_in_international_components)	Nessus	Solaris Local Security Checks	high
75866	openSUSE Security Update : icu (openSUSE-SU-2012:0100-1)	Nessus	SuSE Local Security Checks	high
75530	openSUSE Security Update : icu (openSUSE-SU-2012:0100-1)	Nessus	SuSE Local Security Checks	high
69640	Amazon Linux AMI : icu (ALAS-2012-33)	Nessus	Amazon Linux Local Security Checks	high
68406	Oracle Linux 5 / 6 : icu (ELSA-2011-1815)	Nessus	Oracle Linux Local Security Checks	critical
64157	SuSE 11.2 Security Update : icu (SAT Patch Number 7204)	Nessus	SuSE Local Security Checks	high
62357	Apple TV < 5.1 Multiple Vulnerabilities	Nessus	Gain a shell remotely	high
62288	GLSA-201209-07 : International Components for Unicode: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
6589	Apple iOS < 6.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
62242	Apple iOS < 6.0 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
6583	Mac OS X 10.7 < 10.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	critical
62213	Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)	Nessus	MacOS X Local Security Checks	critical
61205	Scientific Linux Security Update : icu on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
58577	SuSE 10 Security Update : LibreOffice (ZYPP Patch Number 8022)	Nessus	SuSE Local Security Checks	high
57737	Debian DSA-2397-1 : icu - buffer underflow	Nessus	Debian Local Security Checks	high
57706	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : icu vulnerability (USN-1348-1)	Nessus	Ubuntu Local Security Checks	high
57613	SuSE 11.1 Security Update : icu (SAT Patch Number 5653)	Nessus	SuSE Local Security Checks	high
57407	Mandriva Linux Security Advisory : icu (MDVSA-2011:194)	Nessus	Mandriva Local Security Checks	high
57388	Fedora 15 : icu-4.4.2-9.fc15 (2011-17119)	Nessus	Fedora Local Security Checks	high
57386	Fedora 16 : icu-4.6-3.fc16 (2011-17101)	Nessus	Fedora Local Security Checks	high
57296	RHEL 5 / 6 : icu (RHSA-2011:1815)	Nessus	Red Hat Local Security Checks	high
57291	CentOS 5 / 6 : icu (CESA-2011:1815)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2011-4599

critical

Tenable Plugins

high

high

high

high

critical

high

high

high

high

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high