FYI. Note plug for harfbuzz.<div>-s</div><div><br><br>---------- Forwarded message ----------<br>From: <b>Steven R. Loomis</b> <br>Date: Friday, April 19, 2013<br>Subject: Patch: Multiple security vulnerabilities in ICU Layout Engine<br>
To: <a href="mailto:icu-announce@lists.sourceforge.net">icu-announce@lists.sourceforge.net</a><br><br><br><div>(FYI: I did not mention HarfBuzz in the post to icu-announce. However, the download page does mention it.)</div>
<br><div><span style="font-family:Arial,Verdana,sans-serif">( This information is available on <a href="http://site.icu-project.org/download/51" target="_blank">http://site.icu-project.org/download/51</a> )</span></div>
<font face="Arial, Verdana, sans-serif"><div><font face="Arial, Verdana, sans-serif"><br></font></div>Dear ICU users and friends,</font><div><font face="Arial, Verdana, sans-serif"> Please find below information about a patch, affecting ALL versions of the ICU layout engine.</font></div>
<div><font face="Arial, Verdana, sans-serif"><br></font><div><ul><ul><li><font size="4"><font face="Arial, Verdana, sans-serif">2013-Apr-18: Security Vulnerabilities in the Layout Engine. </font><font face="Arial, Verdana, sans-serif"><a href="http://bugs.icu-project.org/trac/ticket/10107" target="_blank">http://bugs.icu-project.org/trac/ticket/10107</a> </font><font face="Arial, Verdana, sans-serif"> (ALL prior versions)</font><br>
</font><b style="font-family:Arial,Verdana,sans-serif;font-size:13px"><font size="3">Applications which use fonts from untrusted sources are vulnerable to security issues.</font></b></li><ul style="font-family:Arial,Verdana,sans-serif">
<li style="font-size:13px"><font><font size="3"><b>Scope: </b>These issues do not affect applications which don't use the ICU Layout Engine. These issues would primarily affect applications which process fonts from untrusted sources, such as webfonts.</font></font></li>
<li style="font-size:13px"><font><font size="3"><b>NOTE: </b>Applications <b>must</b> implement <code style="color:rgb(0,96,0)"><b>LEFontInstance::getFontTable(LETag, size_t &length) </b></code> in their LEFontInstance subclasses, so that ICU can properly bounds-check font tables.</font></font></li>
<li style="font-size:13px"><font><font size="3"><b>Cross Reference: </b>The following RedHat Bug #s, CVEs, and Oracle Java bug#s are fixed by the following patch, which is synchronized with the Java 1.7 u update 21:</font></font></li>
<ul style="font-size:13px"><li></li><li><font size="3">RH# 952656 - CVE-2013-2419 OpenJDK: font processing errors (2D, Java #8001031)</font></li><li><font size="3">RH# 952708 - CVE-2013-2383 OpenJDK: font layout and glyph table errors (2D, Java #8004986)</font></li>
<li><font size="3">RH# 952709 - CVE-2013-2384 OpenJDK: font layout and glyph table errors (2D, Java #8004987)</font></li><li><font size="3">RH# 952711 - CVE-2013-1569 OpenJDK: font layout and glyph table errors (2D, Java #8004994)</font></li>
</ul><li><font size="3">Patch is located at: </font> the 'known issues' section of: <a href="http://site.icu-project.org/download/51" target="_blank">http://site.icu-project.org/download/51</a></li></ul></ul></ul>
</div></div>
<ul style="font-size:13px;font-family:Arial,Verdana,sans-serif"><ul><li><font size="3"><b>HarfBuzz: </b>users of ICU Layout are <b>strongly</b> encouraged to consider the <a href="http://www.freedesktop.org/wiki/Software/HarfBuzz" style="color:rgb(85,26,139)" target="_blank">HarfBuzz project</a> as a replacement for the ICU Layout Engine. An ICU team member responsible for the Layout Engine is contributing fixes and features to HarfBuzz, and a drop in wrapper is available to allow use of HarfBuzz as a direct replacement for the ICU layout engine. See: <a href="http://www.freedesktop.org/wiki/Software/HarfBuzz" target="_blank">http://www.freedesktop.org/wiki/Software/HarfBuzz</a> </font></li>
</ul></ul>
<br></div>