oss-sec mailing list archives

CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL)

From: Tomas Hoger <thoger () redhat com>
Date: Tue, 19 May 2015 09:05:59 +0200

On Tue, 5 May 2015 09:19:20 +0100 Pedro Ribeiro wrote:

tl;dr heap and integer overflows in ICU, many packages affected,
unknown if these can be exploited or not - everyone names vulns
nowadays, so I name these I-C-U-FAIL.

...

#1 Vulnerability: Heap overflow
CVE-2014-8146

...

#2 Vulnerability: Integer overflow
CVE-2014-8147


Apparently a typo was made when fixing these issues in Ubuntu and
subsequently in Debian when ids with year 2015 were used instead of
2014.  Incorrect ids are used in patch names and changelogs, but e.g.
USN-2605-1 was released with correct ids.  I assume it's still prudent
to consider 2015 ids for rejection, it's likely they have not been
allocated yet.

http://www.ubuntu.com/usn/usn-2605-1/
https://launchpad.net/ubuntu/+source/icu/52.1-3ubuntu0.3
https://launchpad.net/ubuntu/+source/icu/52.1-6ubuntu0.3
https://launchpad.net/ubuntu/+source/icu/52.1-8ubuntu0.1

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784773

-- 
Tomas Hoger / Red Hat Product Security

Current thread:

[CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL Pedro Ribeiro (May 05)
- CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) Tomas Hoger (May 19)
  - Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) Alessandro Ghedini (May 19)
  - Re: CVE reject request CVE-2015-8146/8147 Marc Deslauriers (May 19)
  - Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) cve-assign (May 19)