PT-2008-6943 · Icu+1 · Libicu38-Dbg+7

Published 1970-01-01 · Updated 2024-06-15 · CVE-2008-1036

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions International Components for Unicode (ICU) library versions prior to 10.5.3 libicu38 versions (affected versions not specified) lib32icu-dev versions (affected versions not specified) lib32icu38 versions (affected versions not specified) icu-doc versions (affected versions not specified) libicu38-dbg versions (affected versions not specified) libicu-dev versions (affected versions not specified)

Description The issue is related to the International Components for Unicode (ICU) library, which omits some invalid character sequences during conversion of some character encodings. This might allow remote attackers to conduct cross-site scripting (XSS) attacks. The vulnerability can be exploited remotely and may lead to disruption of protected information integrity.

Recommendations For International Components for Unicode (ICU) library versions prior to 10.5.3, update to version 10.5.3 or later. For libicu38, lib32icu-dev, lib32icu38, icu-doc, libicu38-dbg, and libicu-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-03449

BDU:2015-03450

BDU:2015-03451

BDU:2015-03452

BDU:2015-03453

BDU:2015-03454

CVE-2008-1036

DSA-1762-1

OPENSUSE-SU-2024:10859-1

RHSA-2009:0296

RHSA-2009_0296

Affected Products

International Components For Unicode

Red Hat

Icu-Doc

Lib32Icu-Dev

Lib32Icu38

Libicu-Dev

Libicu38

Libicu38-Dbg

References · 32

• http://secunia.com/advisories/34777 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1036 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03452 · Security Note
• http://secunia.com/advisories/34290 · Vendor Advisory
• http://secunia.com/advisories/30430 · Vendor Advisory
• http://ubuntu.com/usn/USN-747-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1036 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1697 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03449 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1036 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0296.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1036 · Security Note
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03450 · Security Note
• http://us-cert.gov/cas/techalerts/TA08-150A.html · Patch