elsa-2025-11888

{
  "cves": [
    "CVE-2025-5222"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[74.2-5]\n- ICU-22973 Fix buffer overflow by using CharString\n  Resolves: RHEL-96667\n\n[74.2-4]\n- Bump release for October 2024 mass rebuild:\n  Resolves: RHEL-64018\n\n[74.2-3]\n- Resolves: RHEL-59365 Fix coverity warnings\n\n[74.2-2]\n- Bump release for June 2024 mass rebuild\n\n[74.2-1]\n- Update to 74.2\n\n[74.1-1]\n- Update to 74.1\n\n[73.2-5]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild\n\n[73.2-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild\n\n[73.2-3]\n- Fix broken TestHebrewCalendarInTemporalLeapYear\n\n[73.2-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild\n\n[73.2-1]\n- Update to 73.2\n\n[72.1-3]\n- migrated to SPDX license IDs\n\n[72.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild\n\n[72.1-1]\n- Update to 72.1\n\n[71.1-2]\n- Update timezone data to 2022b\n\n[71.1-1]\n- Update to 71.1\n\n[69.1-7]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild\n\n[69.1-6]\n- Update timezone data to 2022a\n\n[69.1-5]\n- Introduce use_tzdata_update flag\n\n[69.1-4]\n- Update timezone data to 2021a4\n\n[69.1-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild\n\n[69.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild\n\n[69.1-1]\n- Update to 69.1\n\n[67.1-6]\n- Rebuilt for removed libstdc++ symbol (#1937698)\n\n[67.1-5]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild\n\n[67.1-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild\n\n[67.1-3]\n- Replace unversioned %{__python} macro with %{__python3}\n\n[67.1-2]\n- Use make macros\n- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro\n\n[67.1-1]\n- Update to 67.1\n\n[65.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild\n\n[65.1-1]\n- Update to 65.1\n- Add a patch from gentoo to fix the build on s390x\n- Drop arm test disabling patches as they are no longer needed\n\n[63.2-4]\n- Build with Python 3\n\n[63.2-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild\n\n[63.2-2]\n- Resolves: rhbz#1708935 temporarily roll back to 63.1\n\n[63.2-1]\n- Update to 63.2\n\n[63.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild\n\n[63.1-1]\n- Update to 63.1\n\n[62.1-3]\n- Resolves: rhbz#1646703 CVE-2018-18928\n\n[62.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild\n\n[62.1-1]\n- Update to 62.1\n\n[61.1-2]\n- Resolves: rhbz#1582611 Add riscv64 to icu-config.sh\n\n[61.1-1]\n- Update to 61.1\n\n[60.2-3]\n- Update Python 2 dependency declarations to new packaging standards\n  (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)\n\n[60.2-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild\n\n[60.2-1]\n- Update to 60.2\n\n[60.1-2]\n- Resolves: rhbz#1524820 CVE-2017-17484\n\n[60.1-1]\n- Update to 60.1\n\n[57.1-9]\n- Resolves: rhbz#1510932 CVE-2017-14952\n\n[57.1-8]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild\n\n[57.1-7]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild\n\n[57.1-6]\n- Resolves: rhbz#1444101 CVE-2017-7867 CVE-2017-7868\n\n[57.1-5]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild\n\n[57.1-4]\n- dist.rpmgrill: 'Percent signs in specfile changelog should be escaped'\n\n[57.1-3]\n- Resolves: rhbz#1377362 CVE-2016-7415\n\n[57.1-2]\n- Resolves: rhbz#1360340 CVE-2016-6293\n\n[57.1-1]\n- upgrade to upstream ICU 57.1\n\n[56.1-7]\n- make check failure is fatal again\n\n[56.1-6]\n- remove icu-56.1-codes-cache-extend.patch\n\n[56.1-5]\n- even more verbosity and debug output\n- add path to extend ICU's internal cache of codes\n- use license macro\n- provide samples in devel subpackage\n- modernize generally\n\n[56.1-4]\n- %build: make VERBOSE=1\n- %check: keep 'make check' non-fatal while investigating rhbz#1307633\n\n[56.1-3]\n- Resolves: rhbz#1307633 FTBFS, disable check to get build through for now\n\n[56.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild\n\n[56.1-1]\n- Resolves: rhbz#1271353 upgrade to ICU 56.1\n\n[54.1-5]\n- Workaround rhbz#1239574 disabling offending tests on armv7hl\n\n[54.1-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild\n\n[54.1-3]\n- Resolves: rhbz#1190131 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654\n- Resolves: rhbz#1184811 CVE-2014-6585 CVE-2014-6591\n\n[54.1-2]\n- Rebuilt for Fedora 23 Change\n  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code\n\n[54.1-1]\n- Resolves: rhbz#1185433 upgrade to upstream ICU 54.1\n\n[53.1-1]\n- Resolves: rhbz#1130771 upgrade to upstream ICU 53.1\n\n[52.1-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild\n\n[52.1-3]\n- Resolves: rhbz#1106793 bad 2-digit year test case\n\n[52.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild\n\n[52.1-1]\n- upgrade to upstream ICU 52.1\n- Resolves: rhbz#1049265 icu-52.1 is available\n- Resolves: rhbz#1050063 Trivial change to icu-config to support ppc64le\n- drop icu-51-layout-fix-10107.tgz source\n- drop integrated icu.10318.CVE-2013-2924_changeset_34076.patch\n- drop integrated icu.10143.memory.leak.crash.patch\n\n[50.1.2-10]\n- Resolves: rhbz#1015594 CVE-2013-2924 use-after-free\n\n[50.1.2-9]\n- added %{?_isa} to Requires for multi-arch systems\n\n[50.1.2-8]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild\n\n[50.1.2-7]\n- Resolves: rhbz#986814 install icu-config.sh from source2\n\n[50.1.2-6]\n- Resolves: rhbz#966141 various flaws in Layout Engine font processing\n- Resolves: rhbz#966077 aarch64 support for icu-config.sh wrapper\n\n[50.1.2-5]\n- added manpages for gennorm2 and icuinfo, rhbz#884035 related\n\n[50.1.2-4]\n- Resolves: fdo#52519 crash on typing some Malayalam\n\n[50.1.2-3]\n- Resolves: rhbz#856594 roll back and build without --disable-renaming again\n\n[50.1.2-2]\n- Resolves: rhbz#856594 include content of icu/source/uconfig.h.prepend\n\n[50.1.2-1]\n- Update to 50.1.2\n- Resolves: rhbz#856594 to-do add --disable-renaming on next soname bump\n- removed upstream applied icu.9283.regexcmp.crash.patch\n\n[49.1.1-7]\n- Related: rhbz#856594 reenable icu symbol renaming\n\n[49.1.1-6]\n- Resolves: rhbz#856594 disable icu symbol renaming\n\n[49.1.1-5]\n- apply upstream fix (bug 9283) for regexcmp crash causing Chromium segfaults\n\n[49.1.1-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild\n\n[49.1.1-3]\n- probably parallel-build safe by now. Add a check for original breakage\n\n[49.1.1-2]\n- Resolves: rhbz#804313 multi-lib pain\n\n[49.1.1-1]\n- Update to 49.1.1\n\n[4.8.1.1-3]\n- Resolves: rhbz#813484 doxygen 1.8.0 does not provide installdox, omit from install\n\n[4.8.1.1-2]\n- Correct reference to BZ681941, add temporary fix for ARM FTBFS side effect\n\n[-4.8.1.1-1]\n- Update to 4.8.1.1\n\n[4.8.1-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild\n\n[4.8.1-3]\n- Resolves: rhbz#766542 CVE-2011-4599 Stack-based buffer overflow\n- add icu.8984.CVE-2011-4599.patch\n\n[4.8.1-2]\n- Resolves: rhbz#747193 try and enable ccmp for Indic fonts\n\n[4.8.1-1]\n- Resolves: rhbz#681941 don't link unneccessary -lm, etc.\n- add icu.8800.freeserif.crash.patch\n\n[4.6-2]\n- Resolves: rhbz#681941 don't link unneccessary -lm, etc.\n\n[4.6-1]\n- latest version\n- upgrade includes a .pc now of its own, drop ours\n- drop integrated icu.6995.kannada.patch\n- drop integrated icu.7971.buildfix.patch\n- drop integrated icu.7972.buildfix.patch\n- drop integrated icu.7932.doublecompare.patch\n- drop integrated icu.8011.buildfix.patch\n\n[4.4.2-8]\n- Resolves: rhbz#674328 yet more ways that freeserif crashes libicu\n\n[4.4.2-7]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild\n\n[4.4.2-6]\n- Resolves: rhbz#674328 more ways that freeserif crashes libicu\n\n[4.4.2-5]\n- Resolves: rhbz#674328 freeserif crashes libicu\n\n[4.4.2-4]\n- Resolves: rhbz#669237 strip libicudata\n\n[4.4.2-3]\n- Resolves: rhbz#657964 icu-config bindir returns sbindir\n\n[4.4.2-2]\n- Resolves: rhbz#654200 revert icu#5431\n\n[4.4.2-1]\n- latest version\n\n* Wed Sep 29 2010 jkeating - 4.4.1-6\n- Rebuilt for gcc bug 634757\n\n[4.4.1-5]\n- upstream patches\n\n[4.4.1-4]\n- Resolves: rhbz#631403 doxygen no longer generates gifs\n\n[4.4.1-3]\n- move licences into libicu, and add them into the -doc subpackage\n  as well\n\n[4.4.1-2]\n- Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use\n  -fno-strict-aliasig as upstream has added a pile more and doesn't look\n  interested in proposed patchs\n\n[4.4.1-1]\n- latest version\n- drop integrated icu.icu7567.libctest.patch\n\n[4.4-1]\n- latest version\n- drop integrated icu.6969.pkgdata.patch\n- drop integrated icu.icu7039.badextract.patch\n- drop integrated icu.XXXX.buildfix.patch\n\n[4.2.1-8]\n- Resolves: rhbz#543386 update icu-config\n\n[4.2.1-7]\n- Fix FTBFS with yet another autoconf version that changes\n  behaviour\n\n[4.2.1-6]\n- Resolves: rhbz#520468 fix s390x and other secondary archs\n\n[4.2.1-5]\n- icu#7039 fix broken use of extract to get tests working\n\n[4.2.1-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n[4.2.1-3]\n- make documentation noarch\n\n[4.2.1-2]\n- rpmlint warnings\n\n[4.2.1-1]\n- 4.2.1 release\n\n[4.2.0.1-3]\n- Resolves: rhbz#508288 multilib conflict\n\n[4.2.0.1-2]\n- Resolves: rhbz#505252 add icu.6995.kannada.patch\n\n[4.2.0.1-1]\n- 4.2.0.1 release\n\n[4.2-1]\n- 4.2 release\n\n[4.2-0.1.d03]\n- 4.2 release candidate\n- drop resolved icu.icu6008.arm.padding.patch\n- drop resolved icu.icu6439.bare.elif.patch\n\n[4.0.1-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild\n\n[4.0.1-2]\n- fix bare elif for gcc-4.4\n\n[4.0.1-1]\n- 4.0.1 release\n\n[4.0-6]\n- Resolves rhbz#225896 clean up low hanging rpmlint warnings\n\n[4.0-5]\n- drop integrated icu.icu5557.safety.patch\n\n[4.0-4]\n- annoyingly upstream tarball was repacked apparently to remove\n  some unused/cached dirs\n\n[4.0-3]\n- Resolves: rhbz#461348 wrong icu-config\n\n[4.0-2]\n- Resolves: rhbz#459698 drop Malayalam patches. Note test with Rachana/Meera\n  instead of Lohit Malayalam before filing bugs against icu wrt.\n  Malayalam rendering\n\n[4.0-1]\n- final release\n\n[4.0-0.3.d03]\n- 4.0 release candidate\n\n[4.0-0.2.d02]\n- drop icu.icu5498.openoffice.org.patch\n\n[4.0-0.1.d02]\n- 4.0 release candidate\n- drop integrated icu.regexp.patch\n\n[3.8.1-8]\n- add icu.icu6284.strictalias.patch and build with\n  strict-aliasing\n\n[3.8.1-7]\n- Resolves: rhbz#437761 modify to icu.icu6213.worstcase.patch for\n  other worst case expansions\n\n[3.8.1-6]\n- Resolves: rhbz#437761 add icu.icu6213.bengali.worstcase.patch\n\n[3.8.1-5]\n- Resolves: rhbz#431401 split syllables on 1st 0d4d of a 0d4d +\n  (= 0d15  = 0d39) + 0d4d + 0d30 sequence\n\n[3.8.1-4]\n- Resolves: rhbz#431029, rhbz#424661 Remove workaround for 0D31 characters\n\n[3.8.1-3]\n- CVE-2007-4770 CVE-2007-4771 add icu.regexp.patch\n- Resolves: rhbz#423211 fix malalayam stuff in light of syllable\n  changes\n\n[3.8.1-2]\n- remove icu.icu5365.dependantvowels.patch and cleanup\n  icu.icu5506.multiplevowels.patch as they patch and unpatch\n  eachother (thanks George Rhoten for pointing out that madness)\n\n[3.8.1-1]\n- latest version\n- drop fixed icu.icu6084.zwnj.notdef.patch\n\n[3.8-6]\n- Resolves: rhbz#423211 experimental hack for 0d15+0d4d+0d30\n\n[3.8-5]\n- Resolves: rhbz#415541 icu.icu6084.zwnj.notdef.patch\n\n[3.8-4]\n- Resolves: ooo#83991 Malayalam 'Kartika' font fix\n\n[3.8-3]\n- add icu.openoffice.org.patch\n\n[3.8-2]\n- add icu.icu6008.arm.padding.patch to fix an arm problem\n\n[3.8-1]\n- latest version\n\n[3.8-0.2.d02]\n- next release candidate\n\n[3.8-0.2.d01]\n- rebuild\n\n[3.8-0.1.d01]\n- 3.8 release candidate\n- drop integrated icu.icu5433.oriya.patch\n- drop integrated icu.icu5488.assamese.patch\n- drop integrated icu.icu5500.devicetablecrash.patch\n- drop integrated icu.icu5501.sinhala.biggerexpand.patch\n- drop integrated icu.icu5594.gujarati.patch\n- drop integrated icu.icu5465.telegu.patch\n\n[3.6-20]\n- Resolves: rhbz#243984 change the icu group as it is libicu\n  which is 'System Environment/Libraries' not icu\n\n[3.6-19]\n- Resolves: rhbz#220867 Malayalam rendering\n\n[3.6-18]\n- Resolves: rhbz#228457 icu.icu5594.gujarati.patch\n\n[3.6-17]\n- spec cleanups\n\n[3.6-16]\n- Resolves: rhbz#226949 layout telegu like pango\n\n[3.6-15]\n- Resolves: rhbz#214948 icu.icu5506.multiplevowels.patch\n\n[3.6-14]\n- Related: rhbz#216089 add icu.icu5557.safety.patch\n\n[3.6-13]\n- Resolves: rhbz#220433 modify icu.icu5431.malayam.patch\n\n[3.6-12]\n- Resolves: rhbz#214948 icu.icu5506.multiplevowels.patch\n\n[3.6-11]\n- Resolves: rhbz#214555 icu.icu5501.sinhala.biggerexpand.patch\n\n[3.6-10]\n- Resolves: rhbz#214555 icu.icu5500.devicetablecrash.patch\n\n[3.6-9]\n- Resolves: rhbz#213648 extend prev/next to handle ZWJ\n\n[3.6-8]\n- Resolves: rhbz213375 (icu.icu5488.assamese.patch)\n\n[3.6-7]\n- Resolves: rhbz#211258 (icu.icu5465.telegu.patch)\n\n[3.6-6]\n- rh#209391# add icu.icuXXXX.virama.prevnext.patch\n\n[3.6-5]\n- rh#208705# add pkg-config Require for -devel package\n- add icu.icu5431.malayam.patch for rh#208551#/rh#209084#\n- add icu.icu5433.oriya.patch for rh#208559#/rh#209083#\n\n[3.6-4]\n- rebuilt for unwind info generation, broken in gcc-4.1.1-21\n\n[3.6-3]\n- rh#206615# render malayam like pango\n\n[3.6-2]\n- fix rh#205252#/icu#5365 (gnome#121882#/#icu#4026#) to make icu\n  like pango for multiple dependant vowels\n\n[3.6-1]\n- final release\n\n[3.6-0.1.d02]\n- bump\n\n[3.6-0.2.d01]\n- c++ code not alias correct\n\n[3.6-0.1.d01]\n- rh#200728# update to prelease 3.6d01 to pick up on sinhala fixes\n- drop integrated rh190879.patch\n- drop integrated icu-3.4-sinhala1.patch\n\n[3.4-10.1.1]\n- rebuild\n\n[3.4-10.1]\n- rebuild\n\n[3.4-10]\n- rh#194686# BuildRequires\n\n[3.4-9]\n- rh#190879# backport fix\n\n[3.4-8]\n- add Harshula's icu-3.4-sinhala1.patch for some Sinhala support\n\n[3.4-7]\n- add a pkgconfig.pc, make icu-config use it\n\n[3.4-6.2]\n- bump again for double-long bug on ppc(64)\n\n[3.4-6.1]\n- rebuilt for new gcc4.1 snapshot and glibc changes\n\n[3.4-6]\n- add icu-gcc41.patch\n\n[3.4-5]\n- clear execstack requirement for libicudata\n\n[3.4-4]\n- import extra icu.spec into fedora core for openoffice.org\n- build with gcc 4\n\n[3.4-3]\n- Use dist\n- gcc32 does not understand -fstack-protector and\n  --param=ssp-buffer-size=4\n\n[3.4-2]\n- 3.4.\n\n[3.4-0.2.d02]\n- 3.4-d02.\n- Don't ship static libraries.\n\n[3.2-3]\n- Apply upstream case mapping mutex lock removal patch.\n- Build with gcc 3.2 as a temporary workaround for #152495.\n\n[3.2-2]\n- rebuilt\n\n[3.2-1]\n- Don't use %{_smp_mflags} (b.f.u #2357).\n- Remove unnecessary Epochs.\n\n[0:3.2-0.fdr.1]\n- Update to 3.2.\n\n[0:3.0-0.fdr.1]\n- Update to 3.0, datadirs patch no longer needed.\n- Package data in shared libs, drop -locales subpackage.\n- Rename -docs subpackage to libicu-doc, and generate graphs with graphviz.\n\n[0:2.6.1-0.fdr.3]\n- Partial fix for bad datadirs returned by icu-config (works as long as\n  data packaging mode is not 'common' or 'dll').\n\n[0:2.6.1-0.fdr.2]\n- First complete version.\n\n[0:2.6.1-0.fdr.1]\n- Update to 2.6.1.\n\n[0:2.6-0.fdr.1]\n- First build, based on upstream and SuSE 8.2 packages.",
  "id": "ELSA-2025-11888",
  "ovalId": "oval:com.oracle.elsa:def:202511888",
  "source": "oracle_linux",
  "title": "ELSA-2025-11888:  icu security update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2025-11888.html"
}