SUSE-SU-2021:4063-1 Security update for icu.691
An attacker can exploit memory corruption flaws in the ICU library to execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is SUSE-SU-2021:4063-1?
SUSE-SU-2021:4063-1 is a memory corruption vulnerability in icu.691, published on 14 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for icu.691 fixes the following issues:
Renamed package from icu 69.1 for SUSE:SLE-15-SP3:Update. (jsc#SLE-17893)
Fix undefined behaviour in 'ComplexUnitsConverter::applyRounder'
Update to release 69.1
- For Norwegian, 'no' is back to being the canonical code, with 'nb' treated as equivalent. This aligns handling of Norwegian with other macro language codes.
- Binary prefixes in measurement units (KiB, MiB, etc.)
- Time zone offsets from local time with new APIs.
Don't disable testsuite under 'qemu-linux-user'
Fixed an issue when ICU test on 'aarch64 fails. (bsc#1182645)
Drop 'SUSE_ASNEEDED' as the issue was in binutils. (bsc#1182252)
Fix 'pthread' dependency issue. (bsc#1182252)
Update to release 68.2
- Fix memory problem in 'FormattedStringBuilder'
- Fix assertion when 'setKeywordValue w/' long value.
- Fix UBSan breakage on 8bit of rbbi
- fix int32_t overflow in listFormat
- Fix memory handling in MemoryPool::operator=()
- Fix memory leak in AliasReplacer
Add back icu.keyring.
Update to release 68.1
- PluralRules selection for ranges of numbers
- Locale ID canonicalization now conforms to the CLDR spec including edge cases
- DateIntervalFormat supports output options such as capitalization
- Measurement units are normalized in skeleton string output
- Time zone data (tzdata) version 2020d
Add the provides for libicu to Make .Net core can install successfully. (bsc#1167603, bsc#1161007)
Update to version 67.1
- Unicode 13 (ICU-20893, same as in ICU 66)
- Total of 5930 new characters
- 4 new scripts
- 55 new emoji characters, plus additional new sequences
- New CJK extension, first characters in plane 3: U+30000..U+3134A
- New language at Modern coverage: Nigerian Pidgin
- New languages at Basic coverage: Fulah (Adlam), Maithili, Manipuri, Santali, Sindhi (Devanagari), Sundanese
- Region containment: EU no longer includes GB
- Unicode 13 root collation data and Chinese data for collation and transliteration
- DateTimePatternGenerator now obeys the 'hc' preference in the locale identifier
- Various other improvements for ECMA-402 conformance
- Number skeletons have a new 'concise' form that can be used in MessageFormat strings
- Currency formatting options for formal and other currency display name variants
- ListFormatter: new public API to select the style & type
- ListFormatter now selects the proper “and”/“or” form for Spanish & Hebrew.
- Locale ID canonicalization upgraded to implement the complete CLDR spec.
- LocaleMatcher: New option to ignore one-way matches
- acceptLanguage() reimplemented via LocaleMatcher
- Data build tool: tzdbNames.res moved from the 'zone_tree' category to the 'zone_supplemental' category
- Fixed uses of u8'literals' broken by the C++20 introduction of the incompatible char8_t type
- and added a few API overloads to reduce the need for reinterpret_cast.
- Support for manipulating CLDR 37 unit identifiers in MeasureUnit.
- Unicode 13 (ICU-20893, same as in ICU 66)
Drop icu-versioning. (bsc#1159131)
Update to version 66.1
- Unicode 13 support
- Fix uses of u8'literals' broken by C++20 introduction of incompatible char8_t type.
Fixed an issue when Qt apps can't handle non-ASCII filesystem path. ([bsc#1162882)
Remove '/usr/lib(64)/icu/current'. (bsc#1158955)
Which versions are affected by SUSE-SU-2021:4063-1?
Linux distribution packages (1)
icu.691 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 69.1-7.3.2 |
How do I fix SUSE-SU-2021:4063-1?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is SUSE-SU-2021:4063-1 being exploited?
There is no known exploitation of SUSE-SU-2021:4063-1 in the wild and no public exploit code.