{"id": "MANDRIVA_MDVSA-2008-081.NASL", "bulletinFamily": "scanner", "title": "Mandriva Linux Security Advisory : cups (MDVSA-2008:081)", "description": "A heap-based buffer overflow in CUPS 1.2.x and later was discovered by regenrecht of VeriSign iDenfense that could allow a remote attacker to execute arbitrary code via a crafted CGI search expression (CVE-2008-0047).\n\nA validation error in the Hp-GL/2 filter was also discovered (CVE-2008-0053).\n\nFinally, a vulnerability in how CUPS handled GIF files was found by Tomas Hoger of Red Hat, similar to previous issues corrected in PHP, gd, tk, netpbm, and SDL_image (CVE-2008-1373).\n\nThe updated packages have been patched to correct these issues.", "published": "2009-04-23T00:00:00", "modified": "2013-06-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=37420", "reporter": "Tenable", "references": [], "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "type": "nessus", "lastseen": "2017-10-29T13:36:23", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "A heap-based buffer overflow in CUPS 1.2.x and later was discovered by regenrecht of VeriSign iDenfense that could allow a remote attacker to execute arbitrary code via a crafted CGI search expression (CVE-2008-0047).\n\nA validation error in the Hp-GL/2 filter was also discovered (CVE-2008-0053).\n\nFinally, a vulnerability in how CUPS handled GIF files was found by Tomas Hoger of Red Hat, similar to previous issues corrected in PHP, gd, tk, netpbm, and SDL_image (CVE-2008-1373).\n\nThe updated packages have been patched to correct these issues.", "edition": 1, "enchantments": {}, "hash": "56e4c0b3ccd8d24854e1243074fb9efe2e677f2eed44f2294698d7a4ed3108ae", "hashmap": [{"hash": "54910ec5a314fd33a17f4de1694d20f5", "key": "description"}, {"hash": "9528bf8b68a1f7d16e552564f5e29448", "key": "cvelist"}, {"hash": "181928df890badef7ee37b73fc951084", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "197a63ce57b10c1f43b5342b9dd90820", "key": "published"}, {"hash": "d5207db3095fb1c457120a44cda75de2", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "526837706681051344a466f9e51ac982", "key": "naslFamily"}, {"hash": "e57d518687f2e19e1e09784f34a7a753", "key": "href"}, {"hash": "741675b0c28336d0c5ffda45ed98cf99", "key": "pluginID"}, {"hash": "97ea87d6e8ef74740a53e944a5d5c86d", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=37420", "id": "MANDRIVA_MDVSA-2008-081.NASL", "lastseen": "2016-09-26T17:24:04", "modified": "2013-06-01T00:00:00", "naslFamily": "Mandriva Local Security Checks", "objectVersion": "1.2", "pluginID": "37420", "published": "2009-04-23T00:00:00", "references": [], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2008:081. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(37420);\n script_version (\"$Revision: 1.12 $\");\n script_cvs_date(\"$Date: 2013/06/01 00:01:21 $\");\n\n script_cve_id(\"CVE-2008-0047\", \"CVE-2008-0053\", \"CVE-2008-1373\");\n script_xref(name:\"MDVSA\", value:\"2008:081\");\n\n script_name(english:\"Mandriva Linux Security Advisory : cups (MDVSA-2008:081)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A heap-based buffer overflow in CUPS 1.2.x and later was discovered by\nregenrecht of VeriSign iDenfense that could allow a remote attacker to\nexecute arbitrary code via a crafted CGI search expression\n(CVE-2008-0047).\n\nA validation error in the Hp-GL/2 filter was also discovered\n(CVE-2008-0053).\n\nFinally, a vulnerability in how CUPS handled GIF files was found by\nTomas Hoger of Red Hat, similar to previous issues corrected in PHP,\ngd, tk, netpbm, and SDL_image (CVE-2008-1373).\n\nThe updated packages have been patched to correct these issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:cups\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:cups-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:cups-serial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64cups2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64cups2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libcups2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libcups2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:php-cups\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2013 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2007.0\", reference:\"cups-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"cups-common-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"cups-serial-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64cups2-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64cups2-devel-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libcups2-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libcups2-devel-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"php-cups-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2007.1\", reference:\"cups-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"cups-common-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"cups-serial-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64cups2-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64cups2-devel-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libcups2-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libcups2-devel-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"php-cups-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2008.0\", reference:\"cups-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"cups-common-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"cups-serial-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64cups2-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64cups2-devel-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libcups2-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libcups2-devel-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"php-cups-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "Mandriva Linux Security Advisory : cups (MDVSA-2008:081)", "type": "nessus", "viewCount": 0}, "differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:24:04"}], "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "8d92e8ffb48de8895f2b99f68ff35424"}, {"key": "cvelist", "hash": "9528bf8b68a1f7d16e552564f5e29448"}, {"key": "cvss", "hash": "2bdabeb49c44761f9565717ab0e38165"}, {"key": "description", "hash": "54910ec5a314fd33a17f4de1694d20f5"}, {"key": "href", "hash": "e57d518687f2e19e1e09784f34a7a753"}, {"key": "modified", "hash": "97ea87d6e8ef74740a53e944a5d5c86d"}, {"key": "naslFamily", "hash": "526837706681051344a466f9e51ac982"}, {"key": "pluginID", "hash": "741675b0c28336d0c5ffda45ed98cf99"}, {"key": "published", "hash": "197a63ce57b10c1f43b5342b9dd90820"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "9cf00d658b687f030ebe173a0528c567"}, {"key": "sourceData", "hash": "d5207db3095fb1c457120a44cda75de2"}, {"key": "title", "hash": "181928df890badef7ee37b73fc951084"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "18c500edc7a2d43ccabd012d81afa175e25a4d5d176268839b6d391eecd5dab2", "viewCount": 0, "enchantments": {"vulnersScore": 2.8}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2008:081. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(37420);\n script_version (\"$Revision: 1.12 $\");\n script_cvs_date(\"$Date: 2013/06/01 00:01:21 $\");\n\n script_cve_id(\"CVE-2008-0047\", \"CVE-2008-0053\", \"CVE-2008-1373\");\n script_xref(name:\"MDVSA\", value:\"2008:081\");\n\n script_name(english:\"Mandriva Linux Security Advisory : cups (MDVSA-2008:081)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A heap-based buffer overflow in CUPS 1.2.x and later was discovered by\nregenrecht of VeriSign iDenfense that could allow a remote attacker to\nexecute arbitrary code via a crafted CGI search expression\n(CVE-2008-0047).\n\nA validation error in the Hp-GL/2 filter was also discovered\n(CVE-2008-0053).\n\nFinally, a vulnerability in how CUPS handled GIF files was found by\nTomas Hoger of Red Hat, similar to previous issues corrected in PHP,\ngd, tk, netpbm, and SDL_image (CVE-2008-1373).\n\nThe updated packages have been patched to correct these issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:cups\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:cups-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:cups-serial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64cups2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64cups2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libcups2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libcups2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:php-cups\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2013 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2007.0\", reference:\"cups-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"cups-common-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"cups-serial-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64cups2-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64cups2-devel-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libcups2-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libcups2-devel-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"php-cups-1.2.4-1.8mdv2007.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2007.1\", reference:\"cups-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"cups-common-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"cups-serial-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64cups2-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64cups2-devel-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libcups2-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libcups2-devel-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"php-cups-1.2.10-2.6mdv2007.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2008.0\", reference:\"cups-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"cups-common-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"cups-serial-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64cups2-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64cups2-devel-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libcups2-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libcups2-devel-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"php-cups-1.3.6-1.1mdv2008.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "Mandriva Local Security Checks", "pluginID": "37420", "cpe": ["p-cpe:/a:mandriva:linux:lib64cups2", "cpe:/o:mandriva:linux:2007", "p-cpe:/a:mandriva:linux:php-cups", "cpe:/o:mandriva:linux:2007.1", "p-cpe:/a:mandriva:linux:cups-serial", "cpe:/o:mandriva:linux:2008.0", "p-cpe:/a:mandriva:linux:libcups2", "p-cpe:/a:mandriva:linux:lib64cups2-devel", "p-cpe:/a:mandriva:linux:cups", "p-cpe:/a:mandriva:linux:libcups2-devel", "p-cpe:/a:mandriva:linux:cups-common"]}

{"result": {"cve": [{"id": "CVE-2008-0053", "type": "cve", "title": "CVE-2008-0053", "description": "Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.", "published": "2008-03-18T19:44:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0053", "cvelist": ["CVE-2008-0053"], "lastseen": "2017-09-29T14:25:41"}, {"id": "CVE-2008-1373", "type": "cve", "title": "CVE-2008-1373", "description": "Buffer overflow in the gif_read_lzw function in CUPS 1.3.6 allows remote attackers to have an unknown impact via a GIF file with a large code_size value, a similar issue to CVE-2006-4484.", "published": "2008-04-03T20:44:00", "cvss": {"score": 5.8, "vector": "AV:ADJACENT_NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-1373", "cvelist": ["CVE-2008-1373"], "lastseen": "2017-09-29T14:25:48"}, {"id": "CVE-2008-0047", "type": "cve", "title": "CVE-2008-0047", "description": "Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.", "published": "2008-03-18T19:44:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0047", "cvelist": ["CVE-2008-0047"], "lastseen": "2017-09-29T14:25:41"}], "nessus": [{"id": "SUSE9_12117.NASL", "type": "nessus", "title": "SuSE9 Security Update : CUPS (YOU Patch Number 12117)", "description": "- specially crafted GIF files could cause a buffer overflow in the printer filter for image files.\n (CVE-2008-1373)\n\n - specially crafted files could cause a buffer overflow in the HP-GL/2 printer filter. (CVE-2008-0053)", "published": "2009-09-24T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=41203", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-10-29T13:43:25"}, {"id": "SUSE_CUPS-5115.NASL", "type": "nessus", "title": "SuSE 10 Security Update : CUPS (ZYPP Patch Number 5115)", "description": "- specially crafted GIF files could cause a buffer overflow in the printer filter for image files.\n (CVE-2008-1373)\n\n - specially crafted files could cause a buffer overflow in the HP-GL/2 printer filter. (CVE-2008-0053)", "published": "2008-04-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=31769", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-10-29T13:42:53"}, {"id": "SUSE_CUPS-5117.NASL", "type": "nessus", "title": "openSUSE 10 Security Update : cups (cups-5117)", "description": "- specially crafted GIF files could cause a buffer overflow in the printer filter for image files (CVE-2008-1373).\n\n - specially crafted files could cause a buffer overflow in the HP-GL/2 printer filter (CVE-2008-0053).", "published": "2008-04-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=31770", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-10-29T13:38:49"}, {"id": "REDHAT-RHSA-2008-0192.NASL", "type": "nessus", "title": "RHEL 5 : cups (RHSA-2008:0192)", "description": "Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.\n\nA heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)\n\nRed Hat would like to thank 'regenrecht' for reporting this issue.\n\nThis issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3 or 4.\n\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.\n(CVE-2008-0053)\n\nA buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.\nAn attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.\n(CVE-2008-1373)\n\nAll cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.", "published": "2008-04-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=31754", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-10-29T13:40:38"}, {"id": "CENTOS_RHSA-2008-0192.NASL", "type": "nessus", "title": "CentOS 5 : cups (CESA-2008:0192)", "description": "Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.\n\nA heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)\n\nRed Hat would like to thank 'regenrecht' for reporting this issue.\n\nThis issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3 or 4.\n\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.\n(CVE-2008-0053)\n\nA buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.\nAn attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.\n(CVE-2008-1373)\n\nAll cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.", "published": "2010-01-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=43677", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-10-29T13:33:19"}, {"id": "ORACLELINUX_ELSA-2008-0192.NASL", "type": "nessus", "title": "Oracle Linux 5 : cups (ELSA-2008-0192)", "description": "From Red Hat Security Advisory 2008:0192 :\n\nUpdated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.\n\nA heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the 'lp' user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port. (CVE-2008-0047)\n\nRed Hat would like to thank 'regenrecht' for reporting this issue.\n\nThis issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3 or 4.\n\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.\n(CVE-2008-0053)\n\nA buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.\nAn attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.\n(CVE-2008-1373)\n\nAll cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.", "published": "2013-07-12T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=67670", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-10-29T13:38:07"}, {"id": "FEDORA_2008-2897.NASL", "type": "nessus", "title": "Fedora 7 : cups-1.2.12-10.fc7 (2008-2897)", "description": "Three security issues have been fixed in this update: * A buffer overflow when processing GIF files * A heap-based overflow in a CUPS helper program, used for searching documentation * A buffer overflow when processing HP-GL/2 files\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2008-04-11T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=31816", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-10-29T13:37:20"}, {"id": "DEBIAN_DSA-1625.NASL", "type": "nessus", "title": "Debian DSA-1625-1 : cupsys - buffer overflows", "description": "Several remote vulnerabilities have been discovered in the Common Unix Printing System (CUPS). The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2008-0053 Buffer overflows in the HP-GL input filter allowed to possibly run arbitrary code through crafted HP-GL files.\n\n - CVE-2008-1373 Buffer overflow in the GIF filter allowed to possibly run arbitrary code through crafted GIF files.\n\n - CVE-2008-1722 Integer overflows in the PNG filter allowed to possibly run arbitrary code through crafted PNG files.", "published": "2008-08-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=33774", "cvelist": ["CVE-2008-0053", "CVE-2008-1722", "CVE-2008-1373"], "lastseen": "2017-10-29T13:39:32"}, {"id": "UBUNTU_USN-598-1.NASL", "type": "nessus", "title": "Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : cupsys vulnerabilities (USN-598-1)", "description": "It was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047)\n\nIt was discovered that the hpgl filter in CUPS did not properly validate its input when parsing parameters. If a crafted HP-GL/2 file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.\n(CVE-2008-0053)\n\nIt was discovered that CUPS had a flaw in its managing of remote shared printers via IPP. A remote attacker could send a crafted UDP packet and cause a denial of service or possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.\n(CVE-2008-0882)\n\nIt was discovered that CUPS did not properly perform bounds checking in its GIF decoding routines. If a crafted GIF file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-1373).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2008-04-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=31785", "cvelist": ["CVE-2008-0053", "CVE-2008-0882", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-10-29T13:44:42"}, {"id": "CENTOS_RHSA-2008-0206.NASL", "type": "nessus", "title": "CentOS 3 / 4 : cups (CESA-2008:0206)", "description": "Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.\n\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.\n(CVE-2008-0053)\n\nA buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.\nAn attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.\n(CVE-2008-1373)\n\nIt was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)\n\nAll cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.", "published": "2008-04-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=31741", "cvelist": ["CVE-2005-0206", "CVE-2008-1374", "CVE-2008-0053", "CVE-2004-0888", "CVE-2008-1373"], "lastseen": "2017-10-29T13:44:32"}], "openvas": [{"id": "OPENVAS:136141256231065018", "type": "openvas", "title": "SLES9: Security update for CUPS", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n cups\n cups-client\n cups-devel\n cups-libs\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5023036 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "published": "2009-10-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065018", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2018-04-06T11:39:16"}, {"id": "OPENVAS:136141256231065986", "type": "openvas", "title": "SLES10: Security update for CUPS", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n cups\n cups-client\n cups-devel\n cups-libs\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/", "published": "2009-10-13T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065986", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2018-04-06T11:37:16"}, {"id": "OPENVAS:850017", "type": "openvas", "title": "SuSE Update for cups SUSE-SA:2008:020", "description": "Check for the Version of cups", "published": "2009-01-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=850017", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-12-12T11:19:43"}, {"id": "OPENVAS:65018", "type": "openvas", "title": "SLES9: Security update for CUPS", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n cups\n cups-client\n cups-devel\n cups-libs\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5023036 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "published": "2009-10-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=65018", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-07-26T08:55:53"}, {"id": "OPENVAS:65986", "type": "openvas", "title": "SLES10: Security update for CUPS", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n cups\n cups-client\n cups-devel\n cups-libs\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/", "published": "2009-10-13T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=65986", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-07-26T08:55:12"}, {"id": "OPENVAS:830484", "type": "openvas", "title": "Mandriva Update for cups MDVSA-2008:081 (cups)", "description": "Check for the Version of cups", "published": "2009-04-09T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=830484", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-07-24T12:56:26"}, {"id": "OPENVAS:61377", "type": "openvas", "title": "Debian Security Advisory DSA 1625-1 (cupsys)", "description": "The remote host is missing an update to cupsys\nannounced via advisory DSA 1625-1.", "published": "2008-08-15T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=61377", "cvelist": ["CVE-2008-0053", "CVE-2008-1722", "CVE-2008-1373"], "lastseen": "2017-07-24T12:50:20"}, {"id": "OPENVAS:1361412562310830484", "type": "openvas", "title": "Mandriva Update for cups MDVSA-2008:081 (cups)", "description": "Check for the Version of cups", "published": "2009-04-09T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830484", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2018-04-09T11:39:37"}, {"id": "OPENVAS:870174", "type": "openvas", "title": "RedHat Update for cups RHSA-2008:0192-01", "description": "Check for the Version of cups", "published": "2009-03-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=870174", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-07-27T10:56:19"}, {"id": "OPENVAS:1361412562310122600", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2008-0192", "description": "Oracle Linux Local Security Checks ELSA-2008-0192", "published": "2015-10-08T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122600", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-07-24T12:52:48"}], "suse": [{"id": "SUSE-SA:2008:020", "type": "suse", "title": "remote code execution in cups", "description": "Two security issues were fixed in the CUPS printing system, which could be used by an attacker to crash CUPS or to potentially execute malicious code.\n#### Solution\nThere is no known workaround, please install the update packages.", "published": "2008-04-04T16:22:43", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00003.html", "cvelist": ["CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2016-09-04T12:22:38"}, {"id": "SUSE-SA:2008:015", "type": "suse", "title": "remote code execution in cups", "description": "A heap-overflow in the cgiCompileSearch() function of cups could be exploited by remote attackers to execute arbitrary code. The vulnerable function is used by the web-interface which is only available remotely if the print server shares printers over the network.\n#### Solution\nThere is no known workaround, please install the update packages.", "published": "2008-03-19T10:07:43", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00005.html", "cvelist": ["CVE-2008-0047"], "lastseen": "2016-09-04T12:15:09"}], "centos": [{"id": "CESA-2008:0192", "type": "centos", "title": "cups security update", "description": "**CentOS Errata and Security Advisory** CESA-2008:0192\n\n\nThe Common UNIX Printing System (CUPS) provides a portable printing layer\r\nfor UNIX(R) operating systems.\r\n\r\nA heap buffer overflow flaw was found in a CUPS administration interface\r\nCGI script. A local attacker able to connect to the IPP port (TCP port 631)\r\ncould send a malicious request causing the script to crash or, potentially,\r\nexecute arbitrary code as the \"lp\" user. Please note: the default CUPS\r\nconfiguration in Red Hat Enterprise Linux 5 does not allow remote\r\nconnections to the IPP TCP port. (CVE-2008-0047)\r\n\r\nRed Hat would like to thank \"regenrecht\" for reporting this issue.\r\n\r\nThis issue did not affect the versions of CUPS as shipped with Red Hat\r\nEnterprise Linux 3 or 4.\r\n\r\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An\r\nattacker could create a malicious HP-GL/2 file that could possibly execute\r\narbitrary code as the \"lp\" user if the file is printed. (CVE-2008-0053)\r\n\r\nA buffer overflow flaw was discovered in the GIF decoding routines used by\r\nCUPS image converting filters \"imagetops\" and \"imagetoraster\". An attacker\r\ncould create a malicious GIF file that could possibly execute arbitrary\r\ncode as the \"lp\" user if the file was printed. (CVE-2008-1373)\r\n\r\nAll cups users are advised to upgrade to these updated packages, which\r\ncontain backported patches to resolve these issues.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014797.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014798.html\n\n**Affected packages:**\ncups\ncups-devel\ncups-libs\ncups-lpd\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2008-0192.html", "published": "2008-04-02T10:39:09", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2008-April/014797.html", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2017-10-03T18:24:38"}, {"id": "CESA-2008:0206", "type": "centos", "title": "cups security update", "description": "**CentOS Errata and Security Advisory** CESA-2008:0206\n\n\nThe Common UNIX Printing System (CUPS) provides a portable printing layer\r\nfor UNIX(R) operating systems.\r\n\r\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An\r\nattacker could create a malicious HP-GL/2 file that could possibly execute\r\narbitrary code as the \"lp\" user if the file is printed. (CVE-2008-0053)\r\n\r\nA buffer overflow flaw was discovered in the GIF decoding routines used by\r\nCUPS image converting filters \"imagetops\" and \"imagetoraster\". An attacker\r\ncould create a malicious GIF file that could possibly execute arbitrary\r\ncode as the \"lp\" user if the file was printed. (CVE-2008-1373)\r\n\r\nIt was discovered that the patch used to address CVE-2004-0888 in CUPS\r\npackages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the\r\ninteger overflow in the \"pdftops\" filter on 64-bit platforms. An attacker\r\ncould create a malicious PDF file that could possibly execute arbitrary\r\ncode as the \"lp\" user if the file was printed. (CVE-2008-1374)\r\n\r\nAll cups users are advised to upgrade to these updated packages, which\r\ncontain backported patches to resolve these issues.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014795.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014796.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014799.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014800.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014803.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014804.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014805.html\nhttp://lists.centos.org/pipermail/centos-announce/2008-April/014806.html\n\n**Affected packages:**\ncups\ncups-devel\ncups-libs\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2008-0206.html", "published": "2008-04-01T17:06:38", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2008-April/014795.html", "cvelist": ["CVE-2008-1374", "CVE-2008-0053", "CVE-2004-0888", "CVE-2008-1373"], "lastseen": "2017-10-12T14:45:50"}], "oraclelinux": [{"id": "ELSA-2008-0206", "type": "oraclelinux", "title": "cups security update", "description": "cups\n[1.1.22-0.rc1.9.20.2:.6]\n- Applied patch to fix CVE-2008-0053 (HP-GL/2 input processing, bug #438117).\n- Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303).\n- Applied patch to fix CVE-2008-1374 (64-bit PDF crash, bug #438336).", "published": "2008-04-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2008-0206.html", "cvelist": ["CVE-2008-1374", "CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2016-09-04T11:16:19"}, {"id": "ELSA-2008-0192", "type": "oraclelinux", "title": "cups security update", "description": "cups\n[1.2.4-11.14:.6]\n- Applied patch to fix CVE-2008-0053 (HP-GL/2 input processing, bug #438117).\n- Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303).\n[1.2.4-11.14:.5]\n- Applied patch to prevent heap-based buffer overflow in CUPS helper\n program (bug #436153, CVE-2008-0047, STR #2729).", "published": "2008-04-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2008-0192.html", "cvelist": ["CVE-2008-0053", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2016-09-04T11:17:14"}], "debian": [{"id": "DSA-1625", "type": "debian", "title": "cupsys -- buffer overflows", "description": "Several remote vulnerabilities have been discovered in the Common Unix Printing System (CUPS). The Common Vulnerabilities and Exposures project identifies the following problems:\n\n * [CVE-2008-0053](<https://security-tracker.debian.org/tracker/CVE-2008-0053>)\n\nBuffer overflows in the HP-GL input filter allowed to possibly run arbitrary code through crafted HP-GL files.\n\n * [CVE-2008-1373](<https://security-tracker.debian.org/tracker/CVE-2008-1373>)\n\nBuffer overflow in the GIF filter allowed to possibly run arbitrary code through crafted GIF files.\n\n * [CVE-2008-1722](<https://security-tracker.debian.org/tracker/CVE-2008-1722>)\n\nInteger overflows in the PNG filter allowed to possibly run arbitrary code through crafted PNG files.\n\nFor the stable distribution (etch), these problems have been fixed in version 1.2.7-4etch4 of package cupsys.\n\nFor the testing (lenny) and unstable distribution (sid), these problems have been fixed in version 1.3.7-2 of package cups.\n\nWe recommend that you upgrade your cupsys package.", "published": "2008-08-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-1625", "cvelist": ["CVE-2008-0053", "CVE-2008-1722", "CVE-2008-1373"], "lastseen": "2016-09-02T18:33:12"}, {"id": "DSA-1530", "type": "debian", "title": "cupsys -- Several vulnerabilities", "description": "Several local/remote vulnerabilities have been discovered in cupsys, the Common Unix Printing System. The Common Vulnerabilities and Exposures project identifies the following problems:\n\n * [CVE-2008-0047](<https://security-tracker.debian.org/tracker/CVE-2008-0047>)\n\nHeap-based buffer overflow in CUPS, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions. \n\n * [CVE-2008-0882](<https://security-tracker.debian.org/tracker/CVE-2008-0882>)\n\nDouble free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly the execution of arbitrary code via crafted packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. \n\nFor the stable distribution (etch), these problems have been fixed in version 1.2.7-4etch3.\n\nWe recommend that you upgrade your cupsys packages.", "published": "2008-03-25T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-1530", "cvelist": ["CVE-2008-0882", "CVE-2008-0047"], "lastseen": "2016-09-02T18:29:45"}], "redhat": [{"id": "RHSA-2008:0192", "type": "redhat", "title": "(RHSA-2008:0192) Moderate: cups security update", "description": "The Common UNIX Printing System (CUPS) provides a portable printing layer\r\nfor UNIX(R) operating systems.\r\n\r\nA heap buffer overflow flaw was found in a CUPS administration interface\r\nCGI script. A local attacker able to connect to the IPP port (TCP port 631)\r\ncould send a malicious request causing the script to crash or, potentially,\r\nexecute arbitrary code as the \"lp\" user. Please note: the default CUPS\r\nconfiguration in Red Hat Enterprise Linux 5 does not allow remote\r\nconnections to the IPP TCP port. (CVE-2008-0047)\r\n\r\nRed Hat would like to thank \"regenrecht\" for reporting this issue.\r\n\r\nThis issue did not affect the versions of CUPS as shipped with Red Hat\r\nEnterprise Linux 3 or 4.\r\n\r\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An\r\nattacker could create a malicious HP-GL/2 file that could possibly execute\r\narbitrary code as the \"lp\" user if the file is printed. (CVE-2008-0053)\r\n\r\nA buffer overflow flaw was discovered in the GIF decoding routines used by\r\nCUPS image converting filters \"imagetops\" and \"imagetoraster\". An attacker\r\ncould create a malicious GIF file that could possibly execute arbitrary\r\ncode as the \"lp\" user if the file was printed. (CVE-2008-1373)\r\n\r\nAll cups users are advised to upgrade to these updated packages, which\r\ncontain backported patches to resolve these issues.", "published": "2008-04-01T04:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2008:0192", "cvelist": ["CVE-2008-0047", "CVE-2008-0053", "CVE-2008-1373"], "lastseen": "2017-09-09T07:19:49"}, {"id": "RHSA-2008:0206", "type": "redhat", "title": "(RHSA-2008:0206) Moderate: cups security update", "description": "The Common UNIX Printing System (CUPS) provides a portable printing layer\r\nfor UNIX(R) operating systems.\r\n\r\nTwo overflows were discovered in the HP-GL/2-to-PostScript filter. An\r\nattacker could create a malicious HP-GL/2 file that could possibly execute\r\narbitrary code as the \"lp\" user if the file is printed. (CVE-2008-0053)\r\n\r\nA buffer overflow flaw was discovered in the GIF decoding routines used by\r\nCUPS image converting filters \"imagetops\" and \"imagetoraster\". An attacker\r\ncould create a malicious GIF file that could possibly execute arbitrary\r\ncode as the \"lp\" user if the file was printed. (CVE-2008-1373)\r\n\r\nIt was discovered that the patch used to address CVE-2004-0888 in CUPS\r\npackages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the\r\ninteger overflow in the \"pdftops\" filter on 64-bit platforms. An attacker\r\ncould create a malicious PDF file that could possibly execute arbitrary\r\ncode as the \"lp\" user if the file was printed. (CVE-2008-1374)\r\n\r\nAll cups users are advised to upgrade to these updated packages, which\r\ncontain backported patches to resolve these issues.", "published": "2008-04-01T04:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2008:0206", "cvelist": ["CVE-2004-0888", "CVE-2008-0053", "CVE-2008-1373", "CVE-2008-1374"], "lastseen": "2017-09-08T13:21:09"}], "ubuntu": [{"id": "USN-598-1", "type": "ubuntu", "title": "CUPS vulnerabilities", "description": "It was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047)\n\nIt was discovered that the hpgl filter in CUPS did not properly validate its input when parsing parameters. If a crafted HP-GL/2 file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0053)\n\nIt was discovered that CUPS had a flaw in its managing of remote shared printers via IPP. A remote attacker could send a crafted UDP packet and cause a denial of service or possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0882)\n\nIt was discovered that CUPS did not properly perform bounds checking in its GIF decoding routines. If a crafted GIF file were printed, an attacker could possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-1373)", "published": "2008-04-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/598-1/", "cvelist": ["CVE-2008-0053", "CVE-2008-0882", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2018-03-29T18:19:02"}], "gentoo": [{"id": "GLSA-200804-01", "type": "gentoo", "title": "CUPS: Multiple vulnerabilities", "description": "### Background\n\nCUPS provides a portable printing layer for UNIX-based operating systems. \n\n### Description\n\nMultiple vulnerabilities have been reported in CUPS: \n\n * regenrecht (VeriSign iDefense) discovered that the cgiCompileSearch() function used in several CGI scripts in CUPS' administration interface does not correctly calculate boundaries when processing a user-provided regular expression, leading to a heap-based buffer overflow (CVE-2008-0047).\n * Helge Blischke reported a double free() vulnerability in the process_browse_data() function when adding or removing remote shared printers (CVE-2008-0882).\n * Tomas Hoger (Red Hat) reported that the gif_read_lzw() function uses the code_size value from GIF images without properly checking it, leading to a buffer overflow (CVE-2008-1373).\n * An unspecified input validation error was discovered in the HP-GL/2 filter (CVE-2008-0053).\n\n### Impact\n\nA local attacker could send specially crafted network packets or print jobs and possibly execute arbitrary code with the privileges of the user running CUPS (usually lp), or cause a Denial of Service. The vulnerabilities are exploitable via the network when CUPS is sharing printers remotely. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll CUPS users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-print/cups-1.2.12-r7\"", "published": "2008-04-01T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://security.gentoo.org/glsa/200804-01", "cvelist": ["CVE-2008-0053", "CVE-2008-0882", "CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2016-09-06T19:46:06"}], "seebug": [{"id": "SSV:3063", "type": "seebug", "title": "Apple Mac OS X 2008-002\u66f4\u65b0\u4fee\u590d\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e", "description": "BUGTRAQ ID: 28304\r\nCVE(CAN) ID: CVE-2008-0044,CVE-2008-0045,CVE-2008-0048,CVE-2008-0049,CVE-2008-0057,CVE-2008-0997,CVE-2008-0046,CVE-2008-0051,CVE-2008-0052,CVE-2008-0053,CVE-2008-0054,CVE-2008-0055,CVE-2008-0056,CVE-2008-0058,CVE-2008-0059,CVE-2008-0060,CVE-2008-0987,CVE-2008-0988,CVE-2008-0989,CVE-2008-0990,CVE-2008-0992,CVE-2008-0993,CVE-2008-0994,CVE-2008-0995,CVE-2008-0996,CVE-2008-0998,CVE-2008-0999\r\n\r\nMac OS X\u662f\u82f9\u679c\u5bb6\u65cf\u673a\u5668\u6240\u4f7f\u7528\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nApple 2008-002\u5b89\u5168\u66f4\u65b0\u4fee\u590d\u4e86Mac OS X\u4e2d\u7684\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u6216\u672c\u5730\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u9020\u6210\u591a\u79cd\u5a01\u80c1\u3002\r\n\r\nCVE-2008-0044\r\n\r\nAFP\u5ba2\u6237\u7aef\u5904\u7406afp:// URL\u65f6\u5b58\u5728\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5982\u679c\u7528\u6237\u53d7\u9a97\u8fde\u63a5\u5230\u4e86\u6076\u610f\u7684AFP\u670d\u52a1\u5668\uff0c\u653b\u51fb\u8005\u5c31\u53ef\u80fd\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002 \r\n\r\nCVE-2008-0045\r\n\r\nAFP\u670d\u52a1\u5668\u68c0\u67e5Kerberos\u4e3b\u57df\u540d\u7684\u65b9\u5f0f\u5b58\u5728\u9519\u8bef\uff0c\u5982\u679c\u5bf9AFP\u670d\u52a1\u5668\u4f7f\u7528\u4e86\u8de8\u57df\u8ba4\u8bc1\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5141\u8bb8\u975e\u6388\u6743\u8fde\u63a5\u5230\u670d\u52a1\u5668\u3002 \r\n\r\nCVE-2008-0048\r\n\r\nNSDocument API\u5904\u7406\u6587\u4ef6\u540d\u7684\u65b9\u5f0f\u5b58\u5728\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u4f46\u5728\u5927\u591a\u6570\u6587\u4ef6\u7cfb\u7edf\u4e0a\u8fd9\u4e2a\u6f0f\u6d1e\u4e0d\u53ef\u7528\u3002 \r\n\r\nCVE-2008-0049\r\n\r\nNSApplication\u4e2d\u7528\u4e8e\u7ebf\u7a0b\u95f4\u540c\u6b65\u7684mach\u7aef\u53e3\u65e0\u610f\u4e2d\u63d0\u4f9b\u7ed9\u4e86\u8fdb\u7a0b\u95f4\u901a\u8baf\uff0c\u5982\u679c\u5411\u540c\u4e00bootstrap\u540d\u79f0\u7a7a\u95f4\u7684\u7279\u6743\u5e94\u7528\u53d1\u9001\u4e86\u7279\u5236\u6d88\u606f\u7684\u8bdd\uff0c\u672c\u5730\u7528\u6237\u5c31\u53ef\u4ee5\u5bfc\u81f4\u4ee5\u76ee\u6807\u5e94\u7528\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002 \r\n\r\nCVE-2008-0057\r\n\r\n\u8001\u5f0f\u5e8f\u5217\u53f7\u683c\u5f0f\u7684\u89e3\u6790\u5668\u4e2d\u5b58\u5728\u591a\u4e2a\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5982\u679c\u89e3\u6790\u4e86\u7279\u5236\u7684\u5e8f\u5217\u5316\u5c5e\u6027\u5217\u8868\u7684\u8bdd\uff0c\u5c31\u53ef\u4ee5\u89e6\u53d1\u5806\u6ea2\u51fa\uff0c\u5bfc\u81f4\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0997\r\n\r\nAppKit\u5904\u7406PPD\u6587\u4ef6\u7684\u65b9\u5f0f\u5b58\u5728\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5982\u679c\u7528\u6237\u53d7\u9a97\u67e5\u8be2\u4e86\u7f51\u7edc\u6253\u5370\u673a\u7684\u8bdd\uff0c\u5c31\u4f1a\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0046\r\n\r\n\u5728\u5fb7\u8bed\u7248\u7684\u5e94\u7528\u9632\u706b\u5899\u504f\u597d\u680f\u4e2d\u7684\u201c\u4e3a\u7279\u5b9a\u670d\u52a1\u548c\u5e94\u7528\u8bbe\u7f6e\u8bbf\u95ee\u201d\u952e\u88ab\u7ffb\u8bd1\u6210\u4e86Zugriff auf bestimmte Dienste und Programme festlegen\uff0c\u610f\u601d\u662f\u201c\u8bbe\u7f6e\u5230\u7279\u5b9a\u670d\u52a1\u548c\u5e94\u7528\u7684\u8bbf\u95ee\u201d\uff0c\u8fd9\u53ef\u80fd\u8bef\u5bfc\u7528\u6237\u8ba4\u4e3a\u4ec5\u6709\u5217\u51fa\u7684\u670d\u52a1\u624d\u5141\u8bb8\u63a5\u53d7\u5165\u7ad9\u8fde\u63a5\u3002 \r\n\r\nCVE-2008-0051\r\n\r\nCoreFoundation\u5904\u7406\u65f6\u533a\u6570\u636e\u7684\u65b9\u5f0f\u5b58\u5728\u6574\u6570\u6ea2\u51fa\uff0c\u5141\u8bb8\u672c\u5730\u7528\u6237\u4ee5\u7cfb\u7edf\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0052\r\n\r\n\u5982\u679cSafari\u542f\u7528\u4e86\u201c\u6253\u5f00\u5b89\u5168\u6587\u4ef6\u201d\u9009\u9879\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5728AppleWorks\u4e2d\u81ea\u52a8\u6253\u5f00\u540d\u79f0\u4ee5.ief\u7ed3\u5c3e\u7684\u6587\u4ef6\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u7834\u574f\u5b89\u5168\u7b56\u7565\u3002\r\n\r\nCVE-2008-0053\r\n\r\nCUPS\u4e2d\u7684\u591a\u4e2a\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u53ef\u80fd\u5bfc\u81f4\u4ee5\u7cfb\u7edf\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002 \r\n\r\nCVE-2008-0054\r\n\r\nNSSelectorFromString API\u4e2d\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\uff0c\u5982\u679c\u5bf9\u5176\u4f20\u9001\u4e86\u7578\u5f62\u7684selector\u540d\u79f0\u5c31\u53ef\u80fd\u8fd4\u56de\u975e\u9884\u671f\u7684selector\uff0c\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0055\r\n\r\n\u5728\u6267\u884c\u9012\u5f52\u6587\u4ef6\u62f7\u8d1d\u64cd\u4f5c\u65f6\uff0cNSFileManager\u521b\u5efa\u4e86\u5b8c\u5168\u53ef\u5199\u7684\u76ee\u5f55\uff0c\u4e4b\u540e\u624d\u9650\u5236\u4e86\u6743\u9650\uff0c\u8fd9\u5c31\u9020\u6210\u4e86\u672c\u5730\u7528\u6237\u53ef\u4ee5\u63a7\u5236\u76ee\u5f55\u5e76\u5e72\u9884\u4e4b\u540e\u64cd\u4f5c\u7684\u7ade\u4e89\u6761\u4ef6\uff0c\u5bfc\u81f4\u5c06\u6743\u9650\u63d0\u5347\u5230\u4f7f\u7528API\u5e94\u7528\u7a0b\u5e8f\u7684\u6743\u9650\u3002\r\n\r\nCVE-2008-0056\r\n\r\n\u975e\u9884\u671f\u7ed3\u6784\u7684\u8d85\u957f\u8def\u5f84\u540d\u4f1a\u5728NSFileManager\u4e2d\u89e6\u53d1\u6808\u6ea2\u51fa\uff0c\u5982\u679c\u4f7f\u7528NSFileManager\u63d0\u4f9b\u4e86\u7279\u5236\u7684\u7a0b\u5e8f\u8def\u5f84\u5c31\u53ef\u80fd\u5bfc\u81f4\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0058\r\n\r\nNSURLConnection\u7684\u7f13\u5b58\u7ba1\u7406\u4e2d\u5b58\u5728\u7ebf\u7a0b\u7ade\u4e89\u6761\u4ef6\uff0c\u5bfc\u81f4\u5df2\u6e05\u9664\u7684\u5bf9\u8c61\u63a5\u6536\u6d88\u606f\u3002\u6210\u529f\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u53ef\u80fd\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6216\u4ee5Safari\u6216\u5176\u4ed6\u4f7f\u7528NSURLConnection\u7a0b\u5e8f\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002 \r\n\r\nCVE-2008-0059\r\n\r\nNSXML\u4e2d\u5b58\u5728\u7ade\u4e89\u6761\u4ef6\u3002\u5982\u679c\u8bf1\u9a97\u7528\u6237\u5728\u4f7f\u7528NSXML\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\u5904\u7406\u4e86XML\u6587\u4ef6\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0060\r\n\r\n\u6076\u610f\u7684help:topic_list URL\u53ef\u80fd\u5411\u751f\u6210\u7684\u4e3b\u9898\u5217\u8868\u9875\u9762\u4e2d\u6ce8\u5165\u4efb\u610fHTML\u6216JavaScript\uff0c\u91cd\u65b0\u5b9a\u5411\u5230\u8fd0\u884cApplescript\u7684Help Viewer help:runscript\u94fe\u63a5\u3002\r\n\r\nCVE-2008-0987\r\n\r\nAdobe Digital Negative\uff08DNG\uff09\u56fe\u5f62\u6587\u4ef6\u5904\u7406\u4e2d\u5b58\u5728\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5982\u679c\u7528\u6237\u53d7\u9a97\u6253\u5f00\u4e86\u6076\u610f\u7684\u56fe\u5f62\u6587\u4ef6\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0988\r\n\r\nLibsystem\u7684strnstr(3)\u5b9e\u73b0\u4e2d\u5b58\u5728\u5355\u5b57\u8282\u9519\u8bef\uff0c\u4f7f\u7528strnstr API\u7684\u5e94\u7528\u7a0b\u5e8f\u53ef\u4ee5\u4ece\u7528\u6237\u6307\u5b9a\u7684\u9650\u5236\u8303\u56f4\u5916\u8bfb\u53d6\u4e00\u4e2a\u5b57\u8282\uff0c\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u3002\r\n\r\nCVE-2008-0989\r\n\r\nmDNSResponderHelper\u4e2d\u5b58\u5728\u683c\u5f0f\u4e32\u6f0f\u6d1e\uff0c\u5982\u679c\u5c06\u672c\u5730\u4e3b\u673a\u540d\u8bbe\u7f6e\u4e3a\u6076\u610f\u5b57\u7b26\u4e32\u7684\u8bdd\uff0c\u672c\u5730\u7528\u6237\u5c31\u53ef\u4ee5\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6216\u4ee5DNSResponderHelper\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002 \r\n\r\nCVE-2008-0990\r\n\r\nnotifyd\u6ca1\u6709\u786e\u8ba4\u901a\u77e5\u6765\u81ea\u5185\u6838\u4fbf\u63a5\u53d7\u4e86Mach\u7aef\u53e3\u6b7b\u4ea1\u901a\u77e5\uff0c\u5982\u679c\u672c\u5730\u7528\u6237\u5411notifyd\u53d1\u9001\u4e86\u4f2a\u9020\u7684\u901a\u77e5\u7684\u8bdd\uff0c\u4f7f\u7528notify(3) API\u6ce8\u518c\u901a\u77e5\u7684\u5e94\u7528\u7a0b\u5e8f\u53ef\u80fd\u4e0d\u518d\u63a5\u53d7\u901a\u77e5\u3002 \r\n\r\nCVE-2008-0992\r\n\r\npax\u547d\u4ee4\u884c\u5de5\u5177\u6ca1\u6709\u68c0\u67e5\u8f93\u5165\u4e2d\u7684\u957f\u5ea6\u4fbf\u7528\u4f5c\u4e86\u6570\u7ec4\u7d22\u5f15\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u610f\u5916\u7ec8\u6b62\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0993\r\n\r\nPodcast Capture\u5e94\u7528\u901a\u8fc7\u53c2\u6570\u5411\u5b50\u4efb\u52a1\u63d0\u4f9b\u53e3\u4ee4\uff0c\u8fd9\u53ef\u80fd\u6cc4\u9732\u7ed9\u5176\u4ed6\u672c\u5730\u7528\u6237\u3002\r\n\r\nCVE-2008-0994\r\n\r\n\u5f53Preview\u901a\u8fc7\u52a0\u5bc6\u4fdd\u5b58PDF\u6587\u4ef6\u65f6\uff0c\u4f7f\u7528\u7684\u662f40\u4f4dRC4\u3002\u8fd9\u79cd\u52a0\u5bc6\u7b97\u6cd5\u53ef\u80fd\u88ab\u7834\u89e3\uff0c\u53ef\u8bbf\u95ee\u8be5\u6587\u4ef6\u7684\u7528\u6237\u53ef\u4ee5\u901a\u8fc7\u66b4\u529b\u731c\u6d4b\u67e5\u770b\u8fd9\u4e2a\u6587\u4ef6\u3002\r\n\r\nCVE-2008-0995\r\n\r\n\u6253\u5370PDF\u6587\u4ef6\u548c\u8bbe\u7f6eopen\u53e3\u4ee4\u4f7f\u7528\u7684\u662f40\u4f4dRC4\u3002\u8fd9\u79cd\u52a0\u5bc6\u7b97\u6cd5\u53ef\u80fd\u88ab\u7834\u89e3\uff0c\u53ef\u8bbf\u95ee\u8be5\u6587\u4ef6\u7684\u7528\u6237\u53ef\u4ee5\u901a\u8fc7\u66b4\u529b\u731c\u6d4b\u67e5\u770b\u8fd9\u4e2a\u6587\u4ef6\u3002\r\n\r\nCVE-2008-0996\r\n\r\n\u5904\u7406\u901a\u8fc7\u8ba4\u8bc1\u7684\u6253\u5370\u961f\u5217\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u5f53\u5bf9\u901a\u8fc7\u8ba4\u8bc1\u7684\u6253\u5370\u961f\u5217\u542f\u52a8\u4efb\u52a1\u65f6\uff0c\u5c31\u53ef\u80fd\u5c06\u7528\u4e8e\u8ba4\u8bc1\u7684\u51ed\u636e\u4fdd\u5b58\u5230\u78c1\u76d8\u3002 \r\n\r\nCVE-2008-0998\r\n\r\nNetCfgTool\u7279\u6743\u5de5\u5177\u4f7f\u7528\u5206\u5e03\u5f0f\u5bf9\u8c61\u4e0e\u672c\u5730\u673a\u5668\u4e0a\u7684\u4e0d\u53ef\u4fe1\u4efb\u5ba2\u6237\u7aef\u7a0b\u5e8f\u901a\u8baf\uff0c\u5982\u679c\u53d1\u9001\u4e86\u7279\u5236\u6d88\u606f\u7684\u8bdd\uff0c\u672c\u5730\u7528\u6237\u5c31\u53ef\u4ee5\u7ed5\u8fc7\u6388\u6743\u8fc7\u7a0b\u5bfc\u81f4\u4ee5\u7279\u6743\u7a0b\u5e8f\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\nCVE-2008-0999\r\n\r\n\u5728\u5904\u7406\u901a\u7528\u78c1\u76d8\u683c\u5f0f\uff08UDF\uff09\u6587\u4ef6\u7cfb\u7edf\u65f6\u5b58\u5728\u7a7a\u6307\u9488\u5f15\u7528\uff0c\u5982\u679c\u7528\u6237\u53d7\u9a97\u6253\u5f00\u4e86\u6076\u610f\u7684\u78c1\u76d8\u955c\u50cf\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5bfc\u81f4\u7cfb\u7edf\u610f\u5916\u5173\u95ed\u3002\r\n\n\nApple Mac OS X 10.4.11\r\nApple MacOS X Server 10.5.2\r\nApple MacOS X Server 10.4.11\n Apple\r\n-----\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpdSrvr2008-002PPC.dmg target=_blank>http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpdSrvr2008-002PPC.dmg</a>\r\n<a href=http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpdSrvr2008-002Univ.dmg target=_blank>http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpdSrvr2008-002Univ.dmg</a>\r\n<a href=http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpd2008-002.dmg target=_blank>http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpd2008-002.dmg</a>", "published": "2008-03-20T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.seebug.org/vuldb/ssvid-3063", "cvelist": ["CVE-2008-0044", "CVE-2008-0045", "CVE-2008-0046", "CVE-2008-0048", "CVE-2008-0049", "CVE-2008-0051", "CVE-2008-0052", "CVE-2008-0053", "CVE-2008-0054", "CVE-2008-0055", "CVE-2008-0056", "CVE-2008-0057", "CVE-2008-0058", "CVE-2008-0059", "CVE-2008-0060", "CVE-2008-0987", "CVE-2008-0988", "CVE-2008-0989", "CVE-2008-0990", "CVE-2008-0992", "CVE-2008-0993", "CVE-2008-0994", "CVE-2008-0995", "CVE-2008-0996", "CVE-2008-0997", "CVE-2008-0998", "CVE-2008-0999"], "lastseen": "2017-11-19T21:45:09"}, {"id": "SSV:3117", "type": "seebug", "title": "CUPS gif_read_lzw()\u51fd\u6570GIF\u6587\u4ef6\u5904\u7406\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e", "description": "BUGTRAQ ID: 28544\r\nCVE(CAN) ID: CVE-2008-1373\r\n\r\nCommon Unix Printing System (CUPS)\u662f\u4e00\u6b3e\u901a\u7528Unix\u6253\u5370\u7cfb\u7edf\uff0c\u662fUnix\u73af\u5883\u4e0b\u7684\u8de8\u5e73\u53f0\u6253\u5370\u89e3\u51b3\u65b9\u6848\uff0c\u57fa\u4e8eInternet\u6253\u5370\u534f\u8bae\uff0c\u63d0\u4f9b\u5927\u591a\u6570PostScript\u548craster\u6253\u5370\u673a\u670d\u52a1\u3002\r\n\r\nCUPS\u5904\u7406\u7578\u5f62\u683c\u5f0f\u7684GIF\u6587\u4ef6\u65f6\u5b58\u5728\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u6b64\u6f0f\u6d1e\u63a7\u5236\u670d\u52a1\u5668\u3002\r\n\r\nCUPS\u6253\u5370\u7cfb\u7edf\u6240\u4f7f\u7528\u7684GIF\u89e3\u6790\u4ee3\u7801\u76f4\u63a5\u4eceGIF\u56fe\u5f62\u4e2d\u8bfb\u53d6\u4e86code_size\u503c\uff0c\u4e14\u6ca1\u6709\u7ecf\u8fc7\u9a8c\u8bc1\u4fbf\u7528\u4e8e\u521d\u59cb\u5316gif_read_lzw()\u4e2d\u7684\u8868\u683c\u6570\u7ec4\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u9759\u6001\u6ea2\u51fa\u3002 \u7531\u4e8e\u5728for\u5faa\u73af\u4e2d\u7528\u4f5c\u4e0a\u8fb9\u754c\u7684clear_code\u4e3ashort\u578b\uff0c\u56e0\u6b64\u6ea2\u51fa\u4ec5\u9650\u4e8e\u5927\u7ea64k\u523016k\u7684short int\u503c\u3002\u6b64\u5916\uff0c\u653b\u51fb\u8005\u4ec5\u80fd\u90e8\u5206\u63a7\u5236\u5199\u8fc7\u7f13\u51b2\u533a\u7684\u503c\u3002\r\n\r\n\n\nEasy Software Products CUPS 1.3.6\n \u5382\u5546\u8865\u4e01\uff1a\r\n\r\nEasy Software Products\r\n----------------------\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=http://www.cups.org/str.php?L2765 target=_blank>http://www.cups.org/str.php?L2765</a>\r\n\r\nRedHat\r\n------\r\nRedHat\u5df2\u7ecf\u4e3a\u6b64\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\uff08RHSA-2008:0206-01/RHSA-2008:0192-01\uff09\u4ee5\u53ca\u76f8\u5e94\u8865\u4e01:\r\nRHSA-2008:0206-01\uff1aModerate: cups security update\r\n\u94fe\u63a5\uff1a<a href=https://www.redhat.com/support/errata/RHSA-2008-0206.html target=_blank>https://www.redhat.com/support/errata/RHSA-2008-0206.html</a>\r\n\r\nRHSA-2008:0192-01\uff1aModerate: cups security update\r\n\u94fe\u63a5\uff1a<a href=https://www.redhat.com/support/errata/RHSA-2008-0192.html target=_blank>https://www.redhat.com/support/errata/RHSA-2008-0192.html</a>\r\n\r\nGentoo\r\n------\r\nGentoo\u5df2\u7ecf\u4e3a\u6b64\u53d1\u5e03\u4e86\u4e00\u4e2a\u5b89\u5168\u516c\u544a\uff08GLSA-200804-01\uff09\u4ee5\u53ca\u76f8\u5e94\u8865\u4e01:\r\nGLSA-200804-01\uff1aCUPS: Multiple vulnerabilities\r\n\u94fe\u63a5\uff1a<a href=http://security.gentoo.org/glsa/glsa-200804-01.xml target=_blank>http://security.gentoo.org/glsa/glsa-200804-01.xml</a>\r\n\r\n\u6240\u6709CUPS\u7528\u6237\u90fd\u5e94\u5347\u7ea7\u5230\u6700\u65b0\u7248\u672c\uff1a\r\n\r\n # emerge --sync\r\n # emerge --ask --oneshot --verbose &quot;&gt;=net-print/cups-1.2.12-r7&quot;", "published": "2008-04-03T00:00:00", "cvss": {"score": 5.8, "vector": "AV:ADJACENT_NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.seebug.org/vuldb/ssvid-3117", "cvelist": ["CVE-2008-1373"], "lastseen": "2017-11-19T21:44:31"}, {"id": "SSV:3058", "type": "seebug", "title": "CUPS CGI\u63a5\u53e3\u8fdc\u7a0b\u5806\u6ea2\u51fa\u6f0f\u6d1e", "description": "BUGTRAQ ID: 28307\r\nCVE(CAN) ID: CVE-2008-0047\r\n\r\nCommon Unix Printing System (CUPS)\u662f\u4e00\u6b3e\u901a\u7528Unix\u6253\u5370\u7cfb\u7edf\uff0c\u662fUnix\u73af\u5883\u4e0b\u7684\u8de8\u5e73\u53f0\u6253\u5370\u89e3\u51b3\u65b9\u6848\uff0c\u57fa\u4e8eInternet\u6253\u5370\u534f\u8bae\uff0c\u63d0\u4f9b\u5927\u591a\u6570PostScript\u548craster\u6253\u5370\u673a\u670d\u52a1\u3002\r\n\r\nCUPS\u7684CGI\u63a5\u53e3\u5904\u7406\u7578\u5f62\u7684\u7528\u6237\u8bf7\u6c42\u65f6\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u6b64\u6f0f\u6d1e\u63a7\u5236\u670d\u52a1\u5668\u3002\r\n\r\nCUPS\u5728TCP 631\u7aef\u53e3\u4e0a\u76d1\u542c\u8bf7\u6c42\uff0c\u8fd9\u4e2a\u63a5\u53e3\u5141\u8bb8\u8bbf\u95ee\u4e00\u4e9b\u7528\u4e8e\u7ba1\u7406CUPS\u548c\u63d0\u4f9b\u6253\u5370\u4efb\u52a1\u4fe1\u606f\u7684CGI\u5e94\u7528\u3002\u5982\u679c\u8fdc\u7a0b\u653b\u51fb\u8005\u5411\u8fd9\u4e2a\u7aef\u53e3\u63d0\u4ea4\u4e86\u6076\u610f\u8bf7\u6c42\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u89e6\u53d1\u5806\u6ea2\u51fa\uff0c\u5bfc\u81f4\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\r\n\u5982\u679c\u8981\u8fdc\u7a0b\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\uff0c\u76ee\u6807\u4e3b\u673a\u5fc5\u987b\u5728\u7f51\u7edc\u4e2d\u5171\u4eab\u6253\u5370\u673a\uff0c\u5426\u5219CUPS\u4ec5\u76d1\u542c\u4e8e\u672c\u5730\u63a5\u53e3\uff0c\u800c\u672c\u5730\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u53ea\u80fd\u5bfc\u81f4\u6743\u9650\u63d0\u5347\u3002\r\n\n\nApple Mac OS X 10.5.2 \r\nApple MacOS X Server 10.5.2\r\nEasy Software Products CUPS 1.3.5\n \u4e34\u65f6\u89e3\u51b3\u65b9\u6cd5\uff1a\r\n\r\n* \u7981\u6b62\u8fdc\u7a0b\u5171\u4eab\u6253\u5370\u673a\u3002\r\n\r\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nApple\r\n-----\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpd2008-002.dmg target=_blank>http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&amp;cat=57&amp;platform=osx&amp;method=sa/SecUpd2008-002.dmg</a>", "published": "2008-03-20T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.seebug.org/vuldb/ssvid-3058", "cvelist": ["CVE-2008-0047"], "lastseen": "2017-11-19T21:45:08"}], "slackware": [{"id": "SSA-2008-094-01", "type": "slackware", "title": "cups", "description": "New cups packages are available for Slackware 12.0, and -current to fix\nsecurity issues. The change from CUPS 1.2.x to CUPS 1.3.x was tested here,\nbut if you're on a completely secured internal network these issues may be\nless of a risk than upgrading. If your IPP port is open to the internet,\nyou'd be advised to upgrade as soon as possible (or firewall the port at\nthe gateway if you're not in need of printer jobs coming in from the\ninternet).\n\n\nMore details about the issues may be found in the Common\nVulnerabilities and Exposures (CVE) database:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0047\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1373\n\n\nHere are the details from the Slackware 12.0 ChangeLog:\n\na/cups-1.3.7-i486-1_slack12.0.tgz: Upgraded to cups-1.3.7.\n This version of CUPS fixes some buffer overflows in the GIF image filter\n and in cgiCompileSearch. Those running CUPS servers should upgrade.\n For more information on these security issues, please see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0047\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1373\n (* Security fix *)\n\nWhere to find the new packages:\n\nHINT: Getting slow download speeds from ftp.slackware.com?\nGive slackware.osuosl.org a try. This is another primary FTP site\nfor Slackware that can be considerably faster than downloading\ndirectly from ftp.slackware.com.\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating additional FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the &quot;Get Slack&quot; section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 12.0:\nftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/cups-1.3.7-i486-1_slack12.0.tgz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/cups-1.3.7-i486-1.tgz\n\n\nMD5 signatures:\n\nSlackware 12.0 package:\ncdc732009d2a9a24cd1d06a8be7a7c12 cups-1.3.7-i486-1_slack12.0.tgz\n\nSlackware -current package:\n54e150789acbeccc11903d14579f9590 cups-1.3.7-i486-1.tgz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg cups-1.3.7-i486-1_slack12.0.tgz", "published": "2008-04-03T00:53:48", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384842", "cvelist": ["CVE-2008-1373", "CVE-2008-0047"], "lastseen": "2018-02-02T18:11:30"}]}}