Upstream information

CVE-2008-1036 at MITRE

Description

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
SUSE Bugzilla entry: 489649 [RESOLVED / FIXED]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 11 SP1
  • libicu >= 4.0-7.24.11
  • libicu-32bit >= 4.0-7.24.11
  • libicu-doc >= 4.0-7.24.11
  • libicu-x86 >= 4.0-7.24.11
Patchnames:
SUSE Linux Enterprise Server 11 SP1 GA libicu-32bit
SUSE Linux Enterprise Server 11 SP2
  • libicu >= 4.0-7.26.1
  • libicu-32bit >= 4.0-7.26.1
  • libicu-doc >= 4.0-7.26.1
  • libicu-x86 >= 4.0-7.24.11
Patchnames:
SUSE Linux Enterprise Server 11 SP2 GA libicu-32bit
SUSE Linux Enterprise Server 11 SP3
  • libicu >= 4.0-7.26.15
  • libicu-32bit >= 4.0-7.26.15
  • libicu-doc >= 4.0-7.26.15
  • libicu-x86 >= 4.0-7.26.15
Patchnames:
SUSE Linux Enterprise Server 11 SP3 GA libicu-32bit
SUSE Linux Enterprise Server 11 SP4
  • libicu >= 4.0-7.26.15
  • libicu-32bit >= 4.0-7.26.15
  • libicu-doc >= 4.0-7.26.15
  • libicu-x86 >= 4.0-7.26.15
Patchnames:
SUSE Linux Enterprise Server 11 SP4 GA libicu-32bit
SUSE Linux Enterprise Software Development Kit 11 SP4
  • icu >= 4.0-7.26.15
  • libicu-32bit >= 4.0-7.26.15
  • libicu-devel >= 4.0-7.26.15
  • libicu-devel-32bit >= 4.0-7.26.15
Patchnames:
SUSE Linux Enterprise Software Development Kit 11 SP4 GA icu