GLSA-200803-20 : International Components for Unicode: Multiple vulnerabilities

This script is Copyright (C) 2008-2015 Tenable Network Security, Inc.

Synopsis :

The remote Gentoo host is missing one or more security-related

Description :

The remote host is affected by the vulnerability described in GLSA-200803-20
(International Components for Unicode: Multiple vulnerabilities)

Will Drewry (Google Security) reported a vulnerability in the regular
expression engine when using back references to capture \\0 characters
(CVE-2007-4770). He also found that the backtracking stack size is not
limited, possibly allowing for a heap-based buffer overflow

Impact :

A remote attacker could submit specially crafted regular expressions to
an application using the library, possibly resulting in the remote
execution of arbitrary code with the privileges of the user running the
application or a Denial of Service.

Workaround :

There is no known workaround at this time.

See also :

Solution :

All International Components for Unicode users should upgrade to the
latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=dev-libs/icu-3.8.1-r1'

Risk factor :

High / CVSS Base Score : 9.3

Family: Gentoo Local Security Checks

Nessus Plugin ID: 31446 (gentoo_GLSA-200803-20.nasl)

Bugtraq ID:

CVE ID: CVE-2007-4770

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now