USN-2144-1: CUPS vulnerabilities

Florian Weimer discovered that the pdftoopvp filter bundled in the CUPS package incorrectly handled memory. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. CVE-2013-6474, CVE-2013-6475 Florian Weimer discovered that the pdftoopvp filter...

USN-2143-1: cups-filters vulnerabilities

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. This issue only affected Ubuntu 13.10. CVE-2013-6473 Florian Weimer discovered that cups-filters...

DSA-2876-1 cups - security update

Bulletin has no description...

Debian Security Advisory DSA 2875-1 (cups-filters - security update)

Florian Weimer of the Red Hat Product Security Team discovered multiple vulnerabilities in the pdftoopvp CUPS filter, which could result in the execution of aribitrary code if a malformed PDF file is processed. OpenVAS Vulnerability Test $Id: deb2875.nasl 6724 2017-07-14 09:57:17Z teissa $...

Debian Security Advisory DSA 2876-1 (cups - security update)

Florian Weimer of the Red Hat Product Security Team discovered multiple vulnerabilities in the pdftoopvp CUPS filter, which could result in the execution of aribitrary code if a malformed PDF file is processed. OpenVAS Vulnerability Test $Id: deb2876.nasl 6715 2017-07-13 09:57:40Z teissa $...

Debian: Security Advisory (DSA-2875-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2876-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-6476

The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local users to gain privileges via a Trojan horse driver in the same directory as the PDF file...

CVE-2013-6474

Heap-based buffer overflow in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows remote attackers to execute arbitrary code via a crafted PDF file...

CVE-2013-6473

Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large 1 page or 2 line in a URF file...

CVE-2013-6475

Multiple integer overflows in 1 OPVPOutputDev.cxx and 2 oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow...

CVE-2013-6891

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf...

CVE-2013-6891

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf...

Design/Logic Flaw

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf...

CVE-2013-6891

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf...

CVE-2013-6891

CVE-2013-6891 affects CUPS prior to 1.7.1. The lppasswd tool, when run with setuid, allows local users to read portions of arbitrary files via a crafted HOME environment and a symlink attack on .cups/client.conf. Impact is local information disclosure; there is no remote code execution stated. Th...

CVE-2013-6891

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf...

Fedora 19 : qt-4.8.5-15.fc19 (2013-22932)

Qt Project Security Advisory: XML Entity Expansion Denial of Service CVE-2013-4549 See also http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update : - adds support for the aarch64 architecture, - fixes QTBUG-35459, a too low character limit for XML...

Fedora 20 : qt-4.8.5-15.fc20 (2013-22860)

Qt Project Security Advisory: XML Entity Expansion Denial of Service CVE-2013-4549 See also http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update : - adds support for the aarch64 architecture, - fixes QTBUG-35459, a too low character limit for XML...

Mandriva Linux Security Advisory : cups (MDVSA-2014:015)

Updated cups packages fix security vulnerability : Jann Horn discovered that the CUPS lppasswd tool incorrectly read a user configuration file in certain configurations. A local attacker could use this to read sensitive information from certain files, bypassing access restrictions CVE-2013-6891...