The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3 Red Hat Enterprise Linux 5 and other operating systems omits some invalid character sequences during conversion of some character encodings which might allow remote attackers to conduct cross-site scripting (XSS) attacks.