|Summary:||dev-libs/icu <= 3.8.1 Regular Expressions Vulnerabilities (CVE-2007-(4770|4771))|
|Product:||Gentoo Security||Reporter:||Lars Hartmann <lars>|
|Component:||Vulnerabilities||Assignee:||Gentoo Security <security>|
|Severity:||major||CC:||h.mth, office, php-bugs|
|Package list:||Runtime testing required:||---|
|Bug Depends on:|
Description Lars Hartmann 2008-01-29 07:34:24 UTC
Will Drewry has reported some vulnerabilities in International Components for Unicode, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library. 1) A regular expression containing a back reference to capture group zero (\0) may reference random memory areas, which can be exploited to crash an application using the library. 2) The library does not limit the size of the backtracking stack. This can be exploited to cause a heap-based buffer overflow via certain specially crafted regular expressions. The vulnerability is reported in version 3.8.1. Other versions may also be affected. Solution: Apply patch. http://source.icu-project.org/repos/icu/icu/branches/maint/maint-3-8
Comment 1 Lars Hartmann 2008-01-29 07:37:00 UTC
maintainers - please provide an updated ebuild
Comment 2 Jakub Moc (RETIRED) 2008-01-29 08:17:50 UTC
*** Bug 207905 has been marked as a duplicate of this bug. ***
Comment 3 Robert Buchholz (RETIRED) 2008-02-01 22:51:47 UTC
Comment 4 Robert Buchholz (RETIRED) 2008-02-01 23:35:32 UTC
I reproduced the 4771 issue on 3.6.1. Caolan McNamara from RedHat backported the patches to 3.6: https://bugzilla.redhat.com/show_bug.cgi?id=429023 This bug also affects OpenOffice, as it currently uses an internal copy of icu. OpenOffice herd, please advise here.
Comment 5 Robert Buchholz (RETIRED) 2008-02-02 00:06:31 UTC
OpenOffice, please try building against the (security patched) libicu 3.8.1-r1 here: http://overlays.gentoo.org/svn/proj/php/migration/dev-libs/icu/ If that does not work, please patch the copy of icu.
Comment 6 Andreas Proschofsky (RETIRED) 2008-02-02 18:27:58 UTC
(In reply to comment #5) > OpenOffice, please try building against the (security patched) libicu 3.8.1-r1 > here: http://overlays.gentoo.org/svn/proj/php/migration/dev-libs/icu/ > > If that does not work, please patch the copy of icu. > I've added a new revision (-r1) of openoffice-2.3.1 to portage, this uses external icu again (we had to back this out prior to stabilizing 2.3.1 as it was broken in OOo), works fine here on x86, other archs will have to test accordingly
Comment 7 Christian Hoffmann (RETIRED) 2008-02-02 21:56:35 UTC
icu-3.8.1-r1 with the patch is in the tree now, thanks to jakub. I did not do any tests except from compiling (I haven't touched that package before anyway). I might try building OOo tomorrow, but certainly not today.
Comment 8 Christian Hoffmann (RETIRED) 2008-02-02 22:24:27 UTC
icu-3.6-r2 in the tree as well (with the patch from redhat). You probably want 3.8* stable for OpenOffice anyway, but I don't really know, ask jakub if in doubt. ;)
Comment 9 Jakub Moc (RETIRED) 2008-02-03 08:54:55 UTC
(In reply to comment #8) > icu-3.6-r2 in the tree as well (with the patch from redhat). You probably want > 3.8* stable for OpenOffice anyway, but I don't really know, ask jakub if in > doubt. ;) Well, yes, definitely. It won't compile with ~icu-3.6. arches, please test and stabilize the following: dev-libs/icu-3.6-r2 (will be hanging around for dev-libs/xerces-c-2.8.0 at least unless someone fixes the messy thing to work w/ icu-3.8.x) dev-libs/icu-3.8.1-r1
Comment 10 Brent Baude (RETIRED) 2008-02-03 18:51:14 UTC
ppc and ppc64 done. dertobi123 tested ppc and I committed for his convenience.
Comment 11 Jeroen Roovers (RETIRED) 2008-02-03 23:24:37 UTC
Stable for HPPA.
Comment 12 Christian Faulhammer (RETIRED) 2008-02-04 14:37:16 UTC
Comment 13 Raúl Porcel (RETIRED) 2008-02-07 10:39:53 UTC
Comment 14 Olivier Crete (RETIRED) 2008-02-10 22:51:08 UTC
Comment 15 Jakub Moc (RETIRED) 2008-02-11 09:56:15 UTC
(In reply to comment #14) > amd64 done You missed dev-libs/icu-3.6-r2; thanks.
Comment 16 Steve Dibb (RETIRED) 2008-02-20 04:17:22 UTC
(In reply to comment #15) > (In reply to comment #14) > > amd64 done > > You missed dev-libs/icu-3.6-r2; thanks. > done
Comment 17 Peter Volkov (RETIRED) 2008-02-23 17:54:38 UTC
Updated in release snapshot.
Comment 18 Pierre-Yves Rofes (RETIRED) 2008-03-11 22:16:52 UTC