A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036)

It was discovered that icu, the internal components for Unicode, did not properly sanitise invalid encoded data, which could lead to cross-site scripting attacks.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

From Red Hat Security Advisory 2009:0296 :

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.

It was discovered that libicu did not correctly handle certain invalid encoded data. If a user or automated system were tricked into processing specially crafted data with applications linked against libicu, certain content filters could be bypassed.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

ID	Name	Product	Family	Published	Updated	Severity
60542	Scientific Linux Security Update : icu on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
36076	Debian DSA-1762-1 : icu - insufficient input sanitising	Nessus	Debian Local Security Checks	4/3/2009	1/4/2021	medium
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	5/29/2008	5/28/2024	critical
67807	Oracle Linux 5 : icu (ELSA-2009-0296)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	5/29/2008	5/28/2024	critical
35918	RHEL 5 : icu (RHSA-2009:0296)	Nessus	Red Hat Local Security Checks	3/13/2009	1/14/2021	medium
36537	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : icu vulnerability (USN-747-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	medium
4523	Mac OS X < 10.5.3	Nessus Network Monitor	Generic	8/18/2004	3/6/2019	critical

Detections

Analytics

Plugins Search

medium

medium

critical

medium

critical

medium

medium

critical