cups security update

2008-04-0117:06:38

CentOS Project

lists.centos.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.943

Percentile

99.2%

JSON

CentOS Errata and Security Advisory CESA-2008:0206

The Common UNIX Printing System (CUPS) provides a portable printing layer
for UNIX® operating systems.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An
attacker could create a malicious HP-GL/2 file that could possibly execute
arbitrary code as the “lp” user if the file is printed. (CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by
CUPS image converting filters “imagetops” and “imagetoraster”. An attacker
could create a malicious GIF file that could possibly execute arbitrary
code as the “lp” user if the file was printed. (CVE-2008-1373)

It was discovered that the patch used to address CVE-2004-0888 in CUPS
packages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the
integer overflow in the “pdftops” filter on 64-bit platforms. An attacker
could create a malicious PDF file that could possibly execute arbitrary
code as the “lp” user if the file was printed. (CVE-2008-1374)

All cups users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Affected packages:
cups
cups-devel
cups-libs

Upstream details at:
https://access.redhat.com/errata/RHSA-2008:0206

OSVersionArchitecturePackageVersionFilename
CentOS3i386cups< 1.1.17-13.3.52cups-1.1.17-13.3.52.i386.rpm
CentOS3i386cups-devel< 1.1.17-13.3.52cups-devel-1.1.17-13.3.52.i386.rpm
CentOS3i386cups-libs< 1.1.17-13.3.52cups-libs-1.1.17-13.3.52.i386.rpm
CentOS3x86_64cups< 1.1.17-13.3.52cups-1.1.17-13.3.52.x86_64.rpm
CentOS3x86_64cups-devel< 1.1.17-13.3.52cups-devel-1.1.17-13.3.52.x86_64.rpm
CentOS3i386cups-libs< 1.1.17-13.3.52cups-libs-1.1.17-13.3.52.i386.rpm
CentOS3x86_64cups-libs< 1.1.17-13.3.52cups-libs-1.1.17-13.3.52.x86_64.rpm
CentOS4i386cups< 1.1.22-0.rc1.9.20.2.el4_6.6cups-1.1.22-0.rc1.9.20.2.el4_6.6.i386.rpm
CentOS4i386cups-devel< 1.1.22-0.rc1.9.20.2.el4_6.6cups-devel-1.1.22-0.rc1.9.20.2.el4_6.6.i386.rpm
CentOS4i386cups-libs< 1.1.22-0.rc1.9.20.2.el4_6.6cups-libs-1.1.22-0.rc1.9.20.2.el4_6.6.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	cups	< 1.1.17-13.3.52	cups-1.1.17-13.3.52.i386.rpm
CentOS	3	i386	cups-devel	< 1.1.17-13.3.52	cups-devel-1.1.17-13.3.52.i386.rpm
CentOS	3	i386	cups-libs	< 1.1.17-13.3.52	cups-libs-1.1.17-13.3.52.i386.rpm
CentOS	3	x86_64	cups	< 1.1.17-13.3.52	cups-1.1.17-13.3.52.x86_64.rpm
CentOS	3	x86_64	cups-devel	< 1.1.17-13.3.52	cups-devel-1.1.17-13.3.52.x86_64.rpm
CentOS	3	i386	cups-libs	< 1.1.17-13.3.52	cups-libs-1.1.17-13.3.52.i386.rpm
CentOS	3	x86_64	cups-libs	< 1.1.17-13.3.52	cups-libs-1.1.17-13.3.52.x86_64.rpm
CentOS	4	i386	cups	< 1.1.22-0.rc1.9.20.2.el4_6.6	cups-1.1.22-0.rc1.9.20.2.el4_6.6.i386.rpm
CentOS	4	i386	cups-devel	< 1.1.22-0.rc1.9.20.2.el4_6.6	cups-devel-1.1.22-0.rc1.9.20.2.el4_6.6.i386.rpm
CentOS	4	i386	cups-libs	< 1.1.22-0.rc1.9.20.2.el4_6.6	cups-libs-1.1.22-0.rc1.9.20.2.el4_6.6.i386.rpm