# SUSE-SU-2021:4063-1: Security update for icu.691

> An attacker can exploit memory corruption flaws in the ICU library to execute arbitrary code or cause a denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Dec 2021

## What is SUSE-SU-2021:4063-1?

SUSE-SU-2021:4063-1 is a memory corruption vulnerability in icu.691, published on 14 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

This update for icu.691 fixes the following issues:

- Renamed package from icu 69.1 for SUSE:SLE-15-SP3:Update. (jsc#SLE-17893)
- Fix undefined behaviour in 'ComplexUnitsConverter::applyRounder'

- Update to release 69.1
  - For Norwegian, 'no' is back to being the canonical code, with
    'nb' treated as equivalent. This aligns handling of Norwegian
    with other macro language codes.
  - Binary prefixes in measurement units (KiB, MiB, etc.)
  - Time zone offsets from local time with new APIs.
- Don't disable testsuite under 'qemu-linux-user'
- Fixed an issue when ICU test on 'aarch64 fails. (bsc#1182645)
- Drop 'SUSE_ASNEEDED' as the issue was in binutils. (bsc#1182252)
- Fix 'pthread' dependency issue. (bsc#1182252)

- Update to release 68.2
  - Fix memory problem in 'FormattedStringBuilder'
  - Fix assertion when 'setKeywordValue w/' long value.
  - Fix UBSan breakage on 8bit of rbbi
  - fix int32_t overflow in listFormat
  - Fix memory handling in MemoryPool::operator=()
  - Fix memory leak in AliasReplacer

- Add back icu.keyring.
- Update to release 68.1
  - PluralRules selection for ranges of numbers
  - Locale ID canonicalization now conforms to the CLDR spec including edge cases
  - DateIntervalFormat supports output options such as capitalization
  - Measurement units are normalized in skeleton string output
  - Time zone data (tzdata) version 2020d

- Add the provides for libicu to Make .Net core can install successfully. (bsc#1167603, bsc#1161007) 
- Update to version 67.1
  - Unicode 13 (ICU-20893, same as in ICU 66)
    - Total of 5930 new characters
    - 4 new scripts
    - 55 new emoji characters, plus additional new sequences
    - New CJK extension, first characters in plane 3: U+30000..U+3134A
    - New language at Modern coverage: Nigerian Pidgin
    - New languages at Basic coverage: Fulah (Adlam), Maithili,
      Manipuri, Santali, Sindhi (Devanagari), Sundanese
    - Region containment: EU no longer includes GB
    - Unicode 13 root collation data and Chinese data for collation and transliteration
  - DateTimePatternGenerator now obeys the 'hc' preference in the locale identifier
  - Various other improvements for ECMA-402 conformance
  - Number skeletons have a new 'concise' form that can be used in MessageFormat strings
  - Currency formatting options for formal and other currency display name variants
  - ListFormatter: new public API to select the style & type
  - ListFormatter now selects the proper “and”/“or” form for Spanish & Hebrew.
  - Locale ID canonicalization upgraded to implement the complete CLDR spec.
  - LocaleMatcher: New option to ignore one-way matches
  - acceptLanguage() reimplemented via LocaleMatcher
  - Data build tool: tzdbNames.res moved from the 'zone_tree' category to the 'zone_supplemental' category
  - Fixed uses of u8'literals' broken by the C++20 introduction of the incompatible char8_t type
  - and added a few API overloads to reduce the need for reinterpret_cast.
  - Support for manipulating CLDR 37 unit identifiers in MeasureUnit.

- Drop icu-versioning. (bsc#1159131)
- Update to version 66.1
  - Unicode 13 support
  - Fix uses of u8'literals' broken by C++20 introduction of incompatible char8_t type.

- Fixed an issue when Qt apps can't handle non-ASCII filesystem path. ([bsc#1162882)
- Remove '/usr/lib(64)/icu/current'. (bsc#1158955)

## Which versions are affected by SUSE-SU-2021:4063-1?


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `icu.691` | SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 69.1-7.3.2 |

## How do I fix SUSE-SU-2021:4063-1?

Upgrade to a fixed version.

## Is SUSE-SU-2021:4063-1 being exploited?

There is no known exploitation of SUSE-SU-2021:4063-1 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for SUSE-SU-2021:4063-1 and fix it if it is affected.

What it is: SUSE-SU-2021:4063-1 is a memory corruption vulnerability in icu.691, published on 14 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of SUSE-SU-2021:4063-1 in the wild and no public exploit code.

Affected product: icu.691. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/SUSE-SU-2021-4063-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2021-4063-1/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/SUSE-SU-2021:4063-1

---
From sbomify Insights: https://insights.sbomify.com/SUSE-SU-2021-4063-1/
Summaries are generated and may contain mistakes; the official description above is the record.