The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

From Red Hat Security Advisory 2009:0296 :

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.

A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036)

It was discovered that libicu did not correctly handle certain invalid encoded data. If a user or automated system were tricked into processing specially crafted data with applications linked against libicu, certain content filters could be bypassed.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that icu, the internal components for Unicode, did not properly sanitise invalid encoded data, which could lead to cross-site scripting attacks.

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
67807	Oracle Linux 5 : icu (ELSA-2009-0296)	Nessus	Oracle Linux Local Security Checks	medium
60542	Scientific Linux Security Update : icu on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
36537	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : icu vulnerability (USN-747-1)	Nessus	Ubuntu Local Security Checks	medium
36076	Debian DSA-1762-1 : icu - insufficient input sanitising	Nessus	Debian Local Security Checks	medium
35918	RHEL 5 : icu (RHSA-2009:0296)	Nessus	Red Hat Local Security Checks	medium
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
4523	Mac OS X < 10.5.3	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2008-1036

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

critical