Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2025-11888

Опубликовано: 28 июл. 2025
Источник: oracle-oval
Платформа: Oracle Linux 10

Описание

ELSA-2025-11888: icu security update (MODERATE)

[74.2-5]

  • ICU-22973 Fix buffer overflow by using CharString Resolves: RHEL-96667

[74.2-4]

  • Bump release for October 2024 mass rebuild: Resolves: RHEL-64018

[74.2-3]

  • Resolves: RHEL-59365 Fix coverity warnings

[74.2-2]

  • Bump release for June 2024 mass rebuild

[74.2-1]

  • Update to 74.2

[74.1-1]

  • Update to 74.1

[73.2-5]

[73.2-4]

[73.2-3]

  • Fix broken TestHebrewCalendarInTemporalLeapYear

[73.2-2]

[73.2-1]

  • Update to 73.2

[72.1-3]

  • migrated to SPDX license IDs

[72.1-2]

[72.1-1]

  • Update to 72.1

[71.1-2]

  • Update timezone data to 2022b

[71.1-1]

  • Update to 71.1

[69.1-7]

[69.1-6]

  • Update timezone data to 2022a

[69.1-5]

  • Introduce use_tzdata_update flag

[69.1-4]

  • Update timezone data to 2021a4

[69.1-3]

[69.1-2]

[69.1-1]

  • Update to 69.1

[67.1-6]

  • Rebuilt for removed libstdc++ symbol (#1937698)

[67.1-5]

[67.1-4]

[67.1-3]

  • Replace unversioned %{__python} macro with %{__python3}

[67.1-2]

[67.1-1]

  • Update to 67.1

[65.1-2]

[65.1-1]

  • Update to 65.1
  • Add a patch from gentoo to fix the build on s390x
  • Drop arm test disabling patches as they are no longer needed

[63.2-4]

  • Build with Python 3

[63.2-3]

[63.2-2]

  • Resolves: rhbz#1708935 temporarily roll back to 63.1

[63.2-1]

  • Update to 63.2

[63.1-2]

[63.1-1]

  • Update to 63.1

[62.1-3]

  • Resolves: rhbz#1646703 CVE-2018-18928

[62.1-2]

[62.1-1]

  • Update to 62.1

[61.1-2]

  • Resolves: rhbz#1582611 Add riscv64 to icu-config.sh

[61.1-1]

  • Update to 61.1

[60.2-3]

[60.2-2]

[60.2-1]

  • Update to 60.2

[60.1-2]

  • Resolves: rhbz#1524820 CVE-2017-17484

[60.1-1]

  • Update to 60.1

[57.1-9]

  • Resolves: rhbz#1510932 CVE-2017-14952

[57.1-8]

[57.1-7]

[57.1-6]

  • Resolves: rhbz#1444101 CVE-2017-7867 CVE-2017-7868

[57.1-5]

[57.1-4]

  • dist.rpmgrill: 'Percent signs in specfile changelog should be escaped'

[57.1-3]

  • Resolves: rhbz#1377362 CVE-2016-7415

[57.1-2]

  • Resolves: rhbz#1360340 CVE-2016-6293

[57.1-1]

  • upgrade to upstream ICU 57.1

[56.1-7]

  • make check failure is fatal again

[56.1-6]

  • remove icu-56.1-codes-cache-extend.patch

[56.1-5]

  • even more verbosity and debug output
  • add path to extend ICU's internal cache of codes
  • use license macro
  • provide samples in devel subpackage
  • modernize generally

[56.1-4]

  • %build: make VERBOSE=1
  • %check: keep 'make check' non-fatal while investigating rhbz#1307633

[56.1-3]

  • Resolves: rhbz#1307633 FTBFS, disable check to get build through for now

[56.1-2]

[56.1-1]

  • Resolves: rhbz#1271353 upgrade to ICU 56.1

[54.1-5]

  • Workaround rhbz#1239574 disabling offending tests on armv7hl

[54.1-4]

[54.1-3]

  • Resolves: rhbz#1190131 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654
  • Resolves: rhbz#1184811 CVE-2014-6585 CVE-2014-6591

[54.1-2]

[54.1-1]

  • Resolves: rhbz#1185433 upgrade to upstream ICU 54.1

[53.1-1]

  • Resolves: rhbz#1130771 upgrade to upstream ICU 53.1

[52.1-4]

[52.1-3]

  • Resolves: rhbz#1106793 bad 2-digit year test case

[52.1-2]

[52.1-1]

  • upgrade to upstream ICU 52.1
  • Resolves: rhbz#1049265 icu-52.1 is available
  • Resolves: rhbz#1050063 Trivial change to icu-config to support ppc64le
  • drop icu-51-layout-fix-10107.tgz source
  • drop integrated icu.10318.CVE-2013-2924_changeset_34076.patch
  • drop integrated icu.10143.memory.leak.crash.patch

[50.1.2-10]

  • Resolves: rhbz#1015594 CVE-2013-2924 use-after-free

[50.1.2-9]

  • added %{?_isa} to Requires for multi-arch systems

[50.1.2-8]

[50.1.2-7]

  • Resolves: rhbz#986814 install icu-config.sh from source2

[50.1.2-6]

  • Resolves: rhbz#966141 various flaws in Layout Engine font processing
  • Resolves: rhbz#966077 aarch64 support for icu-config.sh wrapper

[50.1.2-5]

  • added manpages for gennorm2 and icuinfo, rhbz#884035 related

[50.1.2-4]

  • Resolves: fdo#52519 crash on typing some Malayalam

[50.1.2-3]

  • Resolves: rhbz#856594 roll back and build without --disable-renaming again

[50.1.2-2]

  • Resolves: rhbz#856594 include content of icu/source/uconfig.h.prepend

[50.1.2-1]

  • Update to 50.1.2
  • Resolves: rhbz#856594 to-do add --disable-renaming on next soname bump
  • removed upstream applied icu.9283.regexcmp.crash.patch

[49.1.1-7]

  • Related: rhbz#856594 reenable icu symbol renaming

[49.1.1-6]

  • Resolves: rhbz#856594 disable icu symbol renaming

[49.1.1-5]

  • apply upstream fix (bug 9283) for regexcmp crash causing Chromium segfaults

[49.1.1-4]

[49.1.1-3]

  • probably parallel-build safe by now. Add a check for original breakage

[49.1.1-2]

  • Resolves: rhbz#804313 multi-lib pain

[49.1.1-1]

  • Update to 49.1.1

[4.8.1.1-3]

  • Resolves: rhbz#813484 doxygen 1.8.0 does not provide installdox, omit from install

[4.8.1.1-2]

  • Correct reference to BZ681941, add temporary fix for ARM FTBFS side effect

[-4.8.1.1-1]

  • Update to 4.8.1.1

[4.8.1-4]

[4.8.1-3]

  • Resolves: rhbz#766542 CVE-2011-4599 Stack-based buffer overflow
  • add icu.8984.CVE-2011-4599.patch

[4.8.1-2]

  • Resolves: rhbz#747193 try and enable ccmp for Indic fonts

[4.8.1-1]

  • Resolves: rhbz#681941 don't link unneccessary -lm, etc.
  • add icu.8800.freeserif.crash.patch

[4.6-2]

  • Resolves: rhbz#681941 don't link unneccessary -lm, etc.

[4.6-1]

  • latest version
  • upgrade includes a .pc now of its own, drop ours
  • drop integrated icu.6995.kannada.patch
  • drop integrated icu.7971.buildfix.patch
  • drop integrated icu.7972.buildfix.patch
  • drop integrated icu.7932.doublecompare.patch
  • drop integrated icu.8011.buildfix.patch

[4.4.2-8]

  • Resolves: rhbz#674328 yet more ways that freeserif crashes libicu

[4.4.2-7]

[4.4.2-6]

  • Resolves: rhbz#674328 more ways that freeserif crashes libicu

[4.4.2-5]

  • Resolves: rhbz#674328 freeserif crashes libicu

[4.4.2-4]

  • Resolves: rhbz#669237 strip libicudata

[4.4.2-3]

  • Resolves: rhbz#657964 icu-config bindir returns sbindir

[4.4.2-2]

  • Resolves: rhbz#654200 revert icu#5431

[4.4.2-1]

  • latest version
  • Wed Sep 29 2010 jkeating - 4.4.1-6
  • Rebuilt for gcc bug 634757

[4.4.1-5]

  • upstream patches

[4.4.1-4]

  • Resolves: rhbz#631403 doxygen no longer generates gifs

[4.4.1-3]

  • move licences into libicu, and add them into the -doc subpackage as well

[4.4.1-2]

  • Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use -fno-strict-aliasig as upstream has added a pile more and doesn't look interested in proposed patchs

[4.4.1-1]

  • latest version
  • drop integrated icu.icu7567.libctest.patch

[4.4-1]

  • latest version
  • drop integrated icu.6969.pkgdata.patch
  • drop integrated icu.icu7039.badextract.patch
  • drop integrated icu.XXXX.buildfix.patch

[4.2.1-8]

  • Resolves: rhbz#543386 update icu-config

[4.2.1-7]

  • Fix FTBFS with yet another autoconf version that changes behaviour

[4.2.1-6]

  • Resolves: rhbz#520468 fix s390x and other secondary archs

[4.2.1-5]

  • icu#7039 fix broken use of extract to get tests working

[4.2.1-4]

[4.2.1-3]

  • make documentation noarch

[4.2.1-2]

  • rpmlint warnings

[4.2.1-1]

  • 4.2.1 release

[4.2.0.1-3]

  • Resolves: rhbz#508288 multilib conflict

[4.2.0.1-2]

  • Resolves: rhbz#505252 add icu.6995.kannada.patch

[4.2.0.1-1]

  • 4.2.0.1 release

[4.2-1]

  • 4.2 release

[4.2-0.1.d03]

  • 4.2 release candidate
  • drop resolved icu.icu6008.arm.padding.patch
  • drop resolved icu.icu6439.bare.elif.patch

[4.0.1-3]

[4.0.1-2]

  • fix bare elif for gcc-4.4

[4.0.1-1]

  • 4.0.1 release

[4.0-6]

  • Resolves rhbz#225896 clean up low hanging rpmlint warnings

[4.0-5]

  • drop integrated icu.icu5557.safety.patch

[4.0-4]

  • annoyingly upstream tarball was repacked apparently to remove some unused/cached dirs

[4.0-3]

  • Resolves: rhbz#461348 wrong icu-config

[4.0-2]

  • Resolves: rhbz#459698 drop Malayalam patches. Note test with Rachana/Meera instead of Lohit Malayalam before filing bugs against icu wrt. Malayalam rendering

[4.0-1]

  • final release

[4.0-0.3.d03]

  • 4.0 release candidate

[4.0-0.2.d02]

  • drop icu.icu5498.openoffice.org.patch

[4.0-0.1.d02]

  • 4.0 release candidate
  • drop integrated icu.regexp.patch

[3.8.1-8]

  • add icu.icu6284.strictalias.patch and build with strict-aliasing

[3.8.1-7]

  • Resolves: rhbz#437761 modify to icu.icu6213.worstcase.patch for other worst case expansions

[3.8.1-6]

  • Resolves: rhbz#437761 add icu.icu6213.bengali.worstcase.patch

[3.8.1-5]

  • Resolves: rhbz#431401 split syllables on 1st 0d4d of a 0d4d + (>= 0d15 && <= 0d39) + 0d4d + 0d30 sequence

[3.8.1-4]

  • Resolves: rhbz#431029, rhbz#424661 Remove workaround for 0D31 characters

[3.8.1-3]

  • CVE-2007-4770 CVE-2007-4771 add icu.regexp.patch
  • Resolves: rhbz#423211 fix malalayam stuff in light of syllable changes

[3.8.1-2]

  • remove icu.icu5365.dependantvowels.patch and cleanup icu.icu5506.multiplevowels.patch as they patch and unpatch eachother (thanks George Rhoten for pointing out that madness)

[3.8.1-1]

  • latest version
  • drop fixed icu.icu6084.zwnj.notdef.patch

[3.8-6]

  • Resolves: rhbz#423211 experimental hack for 0d15+0d4d+0d30

[3.8-5]

  • Resolves: rhbz#415541 icu.icu6084.zwnj.notdef.patch

[3.8-4]

  • Resolves: ooo#83991 Malayalam 'Kartika' font fix

[3.8-3]

  • add icu.openoffice.org.patch

[3.8-2]

  • add icu.icu6008.arm.padding.patch to fix an arm problem

[3.8-1]

  • latest version

[3.8-0.2.d02]

  • next release candidate

[3.8-0.2.d01]

  • rebuild

[3.8-0.1.d01]

  • 3.8 release candidate
  • drop integrated icu.icu5433.oriya.patch
  • drop integrated icu.icu5488.assamese.patch
  • drop integrated icu.icu5500.devicetablecrash.patch
  • drop integrated icu.icu5501.sinhala.biggerexpand.patch
  • drop integrated icu.icu5594.gujarati.patch
  • drop integrated icu.icu5465.telegu.patch

[3.6-20]

  • Resolves: rhbz#243984 change the icu group as it is libicu which is 'System Environment/Libraries' not icu

[3.6-19]

  • Resolves: rhbz#220867 Malayalam rendering

[3.6-18]

  • Resolves: rhbz#228457 icu.icu5594.gujarati.patch

[3.6-17]

  • spec cleanups

[3.6-16]

  • Resolves: rhbz#226949 layout telegu like pango

[3.6-15]

  • Resolves: rhbz#214948 icu.icu5506.multiplevowels.patch

[3.6-14]

  • Related: rhbz#216089 add icu.icu5557.safety.patch

[3.6-13]

  • Resolves: rhbz#220433 modify icu.icu5431.malayam.patch

[3.6-12]

  • Resolves: rhbz#214948 icu.icu5506.multiplevowels.patch

[3.6-11]

  • Resolves: rhbz#214555 icu.icu5501.sinhala.biggerexpand.patch

[3.6-10]

  • Resolves: rhbz#214555 icu.icu5500.devicetablecrash.patch

[3.6-9]

  • Resolves: rhbz#213648 extend prev/next to handle ZWJ

[3.6-8]

  • Resolves: rhbz213375 (icu.icu5488.assamese.patch)

[3.6-7]

  • Resolves: rhbz#211258 (icu.icu5465.telegu.patch)

[3.6-6]

  • rh#209391# add icu.icuXXXX.virama.prevnext.patch

[3.6-5]

  • rh#208705# add pkg-config Require for -devel package
  • add icu.icu5431.malayam.patch for rh#208551#/rh#209084#
  • add icu.icu5433.oriya.patch for rh#208559#/rh#209083#

[3.6-4]

  • rebuilt for unwind info generation, broken in gcc-4.1.1-21

[3.6-3]

  • rh#206615# render malayam like pango

[3.6-2]

  • fix rh#205252#/icu#5365 (gnome#121882#/#icu#4026#) to make icu like pango for multiple dependant vowels

[3.6-1]

  • final release

[3.6-0.1.d02]

  • bump

[3.6-0.2.d01]

  • c++ code not alias correct

[3.6-0.1.d01]

  • rh#200728# update to prelease 3.6d01 to pick up on sinhala fixes
  • drop integrated rh190879.patch
  • drop integrated icu-3.4-sinhala1.patch

[3.4-10.1.1]

  • rebuild

[3.4-10.1]

  • rebuild

[3.4-10]

  • rh#194686# BuildRequires

[3.4-9]

  • rh#190879# backport fix

[3.4-8]

  • add Harshula's icu-3.4-sinhala1.patch for some Sinhala support

[3.4-7]

  • add a pkgconfig.pc, make icu-config use it

[3.4-6.2]

  • bump again for double-long bug on ppc(64)

[3.4-6.1]

  • rebuilt for new gcc4.1 snapshot and glibc changes

[3.4-6]

  • add icu-gcc41.patch

[3.4-5]

  • clear execstack requirement for libicudata

[3.4-4]

  • import extra icu.spec into fedora core for openoffice.org
  • build with gcc 4

[3.4-3]

  • Use dist
  • gcc32 does not understand -fstack-protector and --param=ssp-buffer-size=4

[3.4-2]

  • 3.4.

[3.4-0.2.d02]

  • 3.4-d02.
  • Don't ship static libraries.

[3.2-3]

  • Apply upstream case mapping mutex lock removal patch.
  • Build with gcc 3.2 as a temporary workaround for #152495.

[3.2-2]

  • rebuilt

[3.2-1]

  • Don't use %{_smp_mflags} (b.f.u #2357).
  • Remove unnecessary Epochs.

[0:3.2-0.fdr.1]

  • Update to 3.2.

[0:3.0-0.fdr.1]

  • Update to 3.0, datadirs patch no longer needed.
  • Package data in shared libs, drop -locales subpackage.
  • Rename -docs subpackage to libicu-doc, and generate graphs with graphviz.

[0:2.6.1-0.fdr.3]

  • Partial fix for bad datadirs returned by icu-config (works as long as data packaging mode is not 'common' or 'dll').

[0:2.6.1-0.fdr.2]

  • First complete version.

[0:2.6.1-0.fdr.1]

  • Update to 2.6.1.

[0:2.6-0.fdr.1]

  • First build, based on upstream and SuSE 8.2 packages.

Обновленные пакеты

Oracle Linux 10

Oracle Linux aarch64

icu

74.2-5.el10_0

libicu

74.2-5.el10_0

libicu-devel

74.2-5.el10_0

Oracle Linux x86_64

icu

74.2-5.el10_0

libicu

74.2-5.el10_0

libicu-devel

74.2-5.el10_0

Связанные CVE

Связанные уязвимости

CVSS3: 7
ubuntu
2 месяца назад

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

CVSS3: 7
redhat
9 месяцев назад

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

CVSS3: 7
nvd
2 месяца назад

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

CVSS3: 7
debian
2 месяца назад

A stack buffer overflow was found in Internationl components for unico ...

suse-cvrf
около 1 месяца назад

Security update for icu