remote code execution in cups

2008-03-1910:07:43

lists.opensuse.org

0.855 High

EPSS

Percentile

98.2%

JSON

A heap-overflow in the cgiCompileSearch() function of cups could be exploited by remote attackers to execute arbitrary code. The vulnerable function is used by the web-interface which is only available remotely if the print server shares printers over the network.

Solution

There is no known workaround, please install the update packages.

OSVersionArchitecturePackageVersionFilename
openSUSE10.2x86_64cups< 1.2.7-12.13cups-1.2.7-12.13.x86_64.rpm
openSUSE10.3i586cups-client< 1.2.12-22.11cups-client-1.2.12-22.11.i586.rpm
openSUSE10.2ppccups-client< 1.2.7-12.13cups-client-1.2.7-12.13.ppc.rpm
openSUSE10.3ppccups-devel< 1.2.12-22.11cups-devel-1.2.12-22.11.ppc.rpm
openSUSE10.2i586cups-libs< 1.2.7-12.13cups-libs-1.2.7-12.13.i586.rpm
openSUSE10.3i586cups-devel< 1.2.12-22.11cups-devel-1.2.12-22.11.i586.rpm
openSUSE10.3x86_64cups-libs< 1.2.12-22.11cups-libs-1.2.12-22.11.x86_64.rpm
openSUSE10.2x86_64cups-libs-32bit< 1.2.7-12.13cups-libs-32bit-1.2.7-12.13.x86_64.rpm
openSUSE10.2ppccups< 1.2.7-12.13cups-1.2.7-12.13.ppc.rpm
openSUSE10.3x86_64cups-devel< 1.2.12-22.11cups-devel-1.2.12-22.11.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
openSUSE	10.2	x86_64	cups	< 1.2.7-12.13	cups-1.2.7-12.13.x86_64.rpm
openSUSE	10.3	i586	cups-client	< 1.2.12-22.11	cups-client-1.2.12-22.11.i586.rpm
openSUSE	10.2	ppc	cups-client	< 1.2.7-12.13	cups-client-1.2.7-12.13.ppc.rpm
openSUSE	10.3	ppc	cups-devel	< 1.2.12-22.11	cups-devel-1.2.12-22.11.ppc.rpm
openSUSE	10.2	i586	cups-libs	< 1.2.7-12.13	cups-libs-1.2.7-12.13.i586.rpm
openSUSE	10.3	i586	cups-devel	< 1.2.12-22.11	cups-devel-1.2.12-22.11.i586.rpm
openSUSE	10.3	x86_64	cups-libs	< 1.2.12-22.11	cups-libs-1.2.12-22.11.x86_64.rpm
openSUSE	10.2	x86_64	cups-libs-32bit	< 1.2.7-12.13	cups-libs-32bit-1.2.7-12.13.x86_64.rpm
openSUSE	10.2	ppc	cups	< 1.2.7-12.13	cups-1.2.7-12.13.ppc.rpm
openSUSE	10.3	x86_64	cups-devel	< 1.2.12-22.11	cups-devel-1.2.12-22.11.x86_64.rpm