MDKSA-2006:010 - Updated cups packages fix several vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:010
http://www.mandriva.com/security/
_______________________________________________________________________
Package : cups
Date : January 10, 2006
Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0
_______________________________________________________________________
Problem Description:
Multiple heap-based buffer overflows in the
DCTStream::readProgressiveSOF and DCTStream::readBaselineSOF functions
in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier,
allow user-complicit attackers to cause a denial of service (heap
corruption) and possibly execute arbitrary code via a crafted PDF file
with an out-of-range number of components (numComps), which is used as
an array index. (CVE-2005-3191)
Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01
allows remote attackers to execute arbitrary code via a PDF file with
an out-of-range numComps (number of components) field. (CVE-2005-3192)
Heap-based buffer overflow in the JPXStream::readCodestream function
in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier
allows user-complicit attackers to cause a denial of service (heap
corruption) and possibly execute arbitrary code via a crafted PDF file
with large size values that cause insufficient memory to be allocated.
(CVE-2005-3193)
An additional patch re-addresses memory allocation routines in
goo/gmem.c (Martin Pitt/Canonical, Dirk Mueller/KDE).
In addition, Chris Evans discovered several other vulnerbilities in
the xpdf code base:
Out-of-bounds heap accesses with large or negative parameters to
"FlateDecode" stream. (CVE-2005-3192)
Out-of-bounds heap accesses with large or negative parameters to
"CCITTFaxDecode" stream. (CVE-2005-3624)
Infinite CPU spins in various places when stream ends unexpectedly.
(CVE-2005-3625)
NULL pointer crash in the "FlateDecode" stream. (CVE-2005-3626)
Overflows of compInfo array in "DCTDecode" stream. (CVE-2005-3627)
Possible to use index past end of array in "DCTDecode" stream.
(CVE-2005-3627)
Possible out-of-bounds indexing trouble in "DCTDecode" stream.
(CVE-2005-3627)
CUPS uses an embedded copy of the xpdf code, with the same
vulnerabilities.
The updated packages have been patched to correct these problems.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3628
_______________________________________________________________________
Updated Packages:
Mandriva Linux 10.1:
b5c52be00b23507bcd130c9e7d1ddd50
10.1/RPMS/cups-1.1.21-0.rc1.7.8.101mdk.i586.rpm
3c98e0ba4a584ca32a2a25eb20b33a39
10.1/RPMS/cups-common-1.1.21-0.rc1.7.8.101mdk.i586.rpm
1fe768077621d37fa855f51baeecd414
10.1/RPMS/cups-serial-1.1.21-0.rc1.7.8.101mdk.i586.rpm
4d8cc497b444ef413726f305af275a6a
10.1/RPMS/libcups2-1.1.21-0.rc1.7.8.101mdk.i586.rpm
a4d621ee0eccb8f95791b991fac95768
10.1/RPMS/libcups2-devel-1.1.21-0.rc1.7.8.101mdk.i586.rpm
7e0e073cfdd7c43d255aa80ed37c28d1
10.1/SRPMS/cups-1.1.21-0.rc1.7.8.101mdk.src.rpm
Mandriva Linux 10.1/X86_64:
c782703a80182ba0f194a3fe59e29671
x86_64/10.1/RPMS/cups-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm
77ddacf0c0a0e327190ff86c797a7eb3
x86_64/10.1/RPMS/cups-common-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm
88f6f078e7bdf537359b12df1b116875
x86_64/10.1/RPMS/cups-serial-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm
bba6774180d2f868f962f8ea8b6e0e51
x86_64/10.1/RPMS/lib64cups2-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm
9cc3515dc6a6655e89a492a3664cea67
x86_64/10.1/RPMS/lib64cups2-devel-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm
7e0e073cfdd7c43d255aa80ed37c28d1
x86_64/10.1/SRPMS/cups-1.1.21-0.rc1.7.8.101mdk.src.rpm
Mandriva Linux 10.2:
5765c4454d6295a4a7cfc6eeeca70c77 10.2/RPMS/cups-1.1.23-11.2.102mdk.i586.rpm
d18d807072f5cc3d1c4ef98a2cf911ab
10.2/RPMS/cups-common-1.1.23-11.2.102mdk.i586.rpm
ef4f68b6a7b2201abd2bb3c70fe296be
10.2/RPMS/cups-serial-1.1.23-11.2.102mdk.i586.rpm
29ae7290946944562087a0191142e9cc
10.2/RPMS/libcups2-1.1.23-11.2.102mdk.i586.rpm
a853346dc6688da93a3231d12c1728f6
10.2/RPMS/libcups2-devel-1.1.23-11.2.102mdk.i586.rpm
5862692ff8114c7f78a808e946c371e6 10.2/SRPMS/cups-1.1.23-11.2.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
9d2e1052c4aeb7f6aad3e0d3c60f85d8
x86_64/10.2/RPMS/cups-1.1.23-11.2.102mdk.x86_64.rpm
8dfe2e759e0749cf7b7acdf077fab2e8
x86_64/10.2/RPMS/cups-common-1.1.23-11.2.102mdk.x86_64.rpm
0ae798ff3cad9bf639db492d3717ff99
x86_64/10.2/RPMS/cups-serial-1.1.23-11.2.102mdk.x86_64.rpm
b85e0f3831dae734217d76930813909b
x86_64/10.2/RPMS/lib64cups2-1.1.23-11.2.102mdk.x86_64.rpm
38f5140a72acf7689b599bef9f923000
x86_64/10.2/RPMS/lib64cups2-devel-1.1.23-11.2.102mdk.x86_64.rpm
5862692ff8114c7f78a808e946c371e6
x86_64/10.2/SRPMS/cups-1.1.23-11.2.102mdk.src.rpm
Mandriva Linux 2006.0:
7fa2fe8c6e545eb18fd69f037688d701
2006.0/RPMS/cups-1.1.23-17.1.20060mdk.i586.rpm
045c02e7fe8e5c5a7c19710170892847
2006.0/RPMS/cups-common-1.1.23-17.1.20060mdk.i586.rpm
d0246199b3ca4cb26e91490fd85994f4
2006.0/RPMS/cups-serial-1.1.23-17.1.20060mdk.i586.rpm
f8b9623d2d7a925196c3496c6f8c491d
2006.0/RPMS/libcups2-1.1.23-17.1.20060mdk.i586.rpm
dca5e3b78ef5941f8f6880197e7c02c0
2006.0/RPMS/libcups2-devel-1.1.23-17.1.20060mdk.i586.rpm
f54c5483e511e5f94706d25d04b9bed7
2006.0/SRPMS/cups-1.1.23-17.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
2f3de58ff175a564fe4949538632af96
x86_64/2006.0/RPMS/cups-1.1.23-17.1.20060mdk.x86_64.rpm
f411ec48c957768194cde193e5693a9e
x86_64/2006.0/RPMS/cups-common-1.1.23-17.1.20060mdk.x86_64.rpm
4ca9fcdc1d9c90c0d00cb5ba4c80ad06
x86_64/2006.0/RPMS/cups-serial-1.1.23-17.1.20060mdk.x86_64.rpm
c869457a90e4113d284730074dfa8b4e
x86_64/2006.0/RPMS/lib64cups2-1.1.23-17.1.20060mdk.x86_64.rpm
98f854ccb1cff62ac98c70213d9da0f8
x86_64/2006.0/RPMS/lib64cups2-devel-1.1.23-17.1.20060mdk.x86_64.rpm
f54c5483e511e5f94706d25d04b9bed7
x86_64/2006.0/SRPMS/cups-1.1.23-17.1.20060mdk.src.rpm
Corporate Server 2.1:
3a4a7fadc8472a8b9df603d06173a12b
corporate/2.1/RPMS/cups-1.1.18-2.12.C21mdk.i586.rpm
8142c0e40cac5993bf87b20867403225
corporate/2.1/RPMS/cups-common-1.1.18-2.12.C21mdk.i586.rpm
a4246d3a163aad65368ad436ee271d3d
corporate/2.1/RPMS/cups-serial-1.1.18-2.12.C21mdk.i586.rpm
61e710d2dbd5c3b24980a3aee8027609
corporate/2.1/RPMS/libcups1-1.1.18-2.12.C21mdk.i586.rpm
26b64c12e3b8b48e214fd7070f547879
corporate/2.1/RPMS/libcups1-devel-1.1.18-2.12.C21mdk.i586.rpm
06625c0147c5e2aaebd3575ed0133e6b
corporate/2.1/SRPMS/cups-1.1.18-2.12.C21mdk.src.rpm
Corporate Server 2.1/X86_64:
fd0907a5db87cc55f999f05183866f4e
x86_64/corporate/2.1/RPMS/cups-1.1.18-2.12.C21mdk.x86_64.rpm
7fb05a22ddee7df584552964b3c29d77
x86_64/corporate/2.1/RPMS/cups-common-1.1.18-2.12.C21mdk.x86_64.rpm
bf0863a6b7616e34678b6866e2c4d6df
x86_64/corporate/2.1/RPMS/cups-serial-1.1.18-2.12.C21mdk.x86_64.rpm
d3925af3dc401c15a7d5a5da02b7469b
x86_64/corporate/2.1/RPMS/libcups1-1.1.18-2.12.C21mdk.x86_64.rpm
fdc4cdf8756b835b28b6e6d6945914e4
x86_64/corporate/2.1/RPMS/libcups1-devel-1.1.18-2.12.C21mdk.x86_64.rpm
06625c0147c5e2aaebd3575ed0133e6b
x86_64/corporate/2.1/SRPMS/cups-1.1.18-2.12.C21mdk.src.rpm
Corporate 3.0:
18480c0d569725ed5f5542a6e118e01a
corporate/3.0/RPMS/cups-1.1.20-5.10.C30mdk.i586.rpm
41eed97b13410174f82c85e43b2b9c9f
corporate/3.0/RPMS/cups-common-1.1.20-5.10.C30mdk.i586.rpm
c371b67e6315faae8afcd686a5f1affb
corporate/3.0/RPMS/cups-serial-1.1.20-5.10.C30mdk.i586.rpm
43f1a46effe9a488642fbe7ba7932477
corporate/3.0/RPMS/libcups2-1.1.20-5.10.C30mdk.i586.rpm
da7a75b3e56a8ad8812bd88e078c4567
corporate/3.0/RPMS/libcups2-devel-1.1.20-5.10.C30mdk.i586.rpm
9540dbf56f41e2f77d573ca2798cf306
corporate/3.0/SRPMS/cups-1.1.20-5.10.C30mdk.src.rpm
Corporate 3.0/X86_64:
fe95777cc7bdfd4b41daf4f9a19186c9
x86_64/corporate/3.0/RPMS/cups-1.1.20-5.10.C30mdk.x86_64.rpm
5e56191f8f14638ab5304ac94df6bb7a
x86_64/corporate/3.0/RPMS/cups-common-1.1.20-5.10.C30mdk.x86_64.rpm
20f1396cf173d3b58d2a1dc4068770d4
x86_64/corporate/3.0/RPMS/cups-serial-1.1.20-5.10.C30mdk.x86_64.rpm
6da98153e198cd3b2456280feae5bdba
x86_64/corporate/3.0/RPMS/lib64cups2-1.1.20-5.10.C30mdk.x86_64.rpm
83d2c68c0180d8ba395bc9c0cb8b1338
x86_64/corporate/3.0/RPMS/lib64cups2-devel-1.1.20-5.10.C30mdk.x86_64.rpm
9540dbf56f41e2f77d573ca2798cf306
x86_64/corporate/3.0/SRPMS/cups-1.1.20-5.10.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDxCNYmqjQ0CJFipgRAl+eAKDi8lnQXk0D+rUq4UvAl5Le1Ze5oQCfUw+7
D4xxg7GHFovst9LlQsfydIs=
=0UJn
-----END PGP SIGNATURE-----