Description
International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | icu | 4.0.1-1 | — |
| Debian 13 | icu | 4.0.1-1 | — |
| Debian 12 | icu | 4.0.1-1 | — |
| Debian 5.0 | icu | 3.8.1-3+lenny2 | DSA-1889-1 |
| Debian 4.0 | icu | 3.6-2etch3 | DSA-1889-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | icu +3 | 3.6-5.11.4 | RHSA-2009:1122 |
Advisories 2
- RHSA-2009:1122 Red Hat Security Advisory: icu security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1889-1 icu - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://support.apple.com/kb/HT3639
- ADV-2009-1621 vdb-entry
- http://support.apple.com/kb/HT3549
- APPLE-SA-2009-06-08-1 vendor-advisory
- RHSA-2009:1122 vendor-advisory
- 35074 third-party-advisory
- macos-icu-security-bypass(50488) vdb-entry
- ADV-2009-1522 vdb-entry
- 34974 vdb-entry
- APPLE-SA-2009-06-17-1 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- http://bugs.icu-project.org/trac/ticket/5691
- FEDORA-2009-6121 vendor-advisory
- 35379 third-party-advisory
- 34926 vdb-entry
- 35498 third-party-advisory
- TA09-133A third-party-advisory
- 35584 third-party-advisory
- ADV-2009-1297 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=503071
- 35436 third-party-advisory
- http://support.apple.com/kb/HT3613
- FEDORA-2009-6273 vendor-advisory
- oval:org.mitre.oval:def:11366 vdb-entry signature