Arch Linux Security Advisory ASA-201711-25 ========================================== Severity: Critical Date : 2017-11-19 CVE-ID : CVE-2017-14952 Package : icu Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-504 Summary ======= The package icu before version 60.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.1-1. # pacman -Syu "icu>=60.1-1" The problem has been fixed upstream in version 60.1. Workaround ========== None. Description =========== Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue. Impact ====== A remote attacker is able to execute arbitrary code on the affected host via a specially crafted string. References ========== http://bugs.icu-project.org/trac/changeset/40324/trunk/icu4c/source/i18n/zon... http://www.sourcebrella.com/blog/double-free-vulnerability-international-com... https://security.archlinux.org/CVE-2017-14952