Package: icu Version: 3.8.1-3+lenny1 Severity: normal Tags: security Hi!
There is a security issue with the stable release of icu (it was fixed in 4.0.1, IIUC): http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0153 "International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks." More details are here: https://bugzilla.redhat.com/show_bug.cgi?id=503071 Thanks! -Kees -- Kees Cook @debian.org -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
