[USN-64-1] xpdf, CUPS vulnerabilities

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 01/19/05

Next message: Martin Pitt: "[USN-67-1] Squid vulnerabilities"

Previous message: j mark: "Re: [Full-Disclosure] Re: [ISN] Book Review: Forensic Discovery"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Wed, 19 Jan 2005 12:00:53 +0100
To: ubuntu-security-announce@lists.ubuntu.com

===========================================================
Ubuntu Security Notice USN-64-1 January 19, 2005
xpdf, cupsys vulnerabilities
CAN-2005-0064
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

cupsys
libcupsimage2
libcupsys2-gnutls10
xpdf-reader
xpdf-utils

The problem can be corrected by upgrading the affected package to
version 1.1.20final+cvs20040330-4ubuntu16.4 (cupsys, libcupsimage2,
and libcupsys2-gnutls10) and 3.00-8ubuntu1.4 (xpdf-reader and
xpdf-utils). In general, a standard system upgrade is sufficient to
effect the necessary changes.

Details follow:

A buffer overflow has been found in the xpdf viewer. An insufficient
input validation of the encryption key length could be exploited by an
attacker providing a specially crafted PDF file which, when processed
by xpdf, could result in abnormal program termination or the execution
of attacker supplied program code with the user's privileges.

The Common UNIX Printing System (CUPS) uses the same code to print PDF
files. In this case, this bug could be exploited to gain the
privileges of the CUPS print server (by default, user cupsys).

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4.diff.gz
      Size/MD5: 1353321 5877c65f6d8f858ae9e176be9ef6410d
    http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4.dsc
      Size/MD5: 867 7a5091f1718ccc0e56b655fb01b8057e
    http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330.orig.tar.gz
      Size/MD5: 5645146 5eb5983a71b26e4af841c26703fc2f79
    http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00-8ubuntu1.4.diff.gz
      Size/MD5: 47899 cbcf2ab245afbabd90086b1022ce65f2
    http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00-8ubuntu1.4.dsc
      Size/MD5: 788 b4eb7934f273cd445ffe844242ba3e0c
    http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00.orig.tar.gz
      Size/MD5: 534697 95294cef3031dd68e65f331e8750b2c2

Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-common_3.00-8ubuntu1.4_all.deb
      Size/MD5: 56410 0f635571ea692f043fdbf3c2e1831253
    http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00-8ubuntu1.4_all.deb
      Size/MD5: 1274 300fa460fc04629eee23c0b4b9447fd7

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

application/pgp-signature attachment: Digital signature

Next message: Martin Pitt: "[USN-67-1] Squid vulnerabilities"

Previous message: j mark: "Re: [Full-Disclosure] Re: [ISN] Book Review: Forensic Discovery"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[USN-48-1] xpdf, tetex-bin vulnerabilities
... xpdf, tetex-bin vulnerabilities ... The following packages are affected: ... and xpdf-utils). ... A potential buffer overflow has been found in the xpdf viewer. ...
(Bugtraq)
[USN-48-1] xpdf, tetex-bin vulnerabilities
... xpdf, tetex-bin vulnerabilities ... The following packages are affected: ... and xpdf-utils). ... A potential buffer overflow has been found in the xpdf viewer. ...
(Full-Disclosure)
[Full-Disclosure] [USN-48-1] xpdf, tetex-bin vulnerabilities
... xpdf, tetex-bin vulnerabilities ... The following packages are affected: ... and xpdf-utils). ... A potential buffer overflow has been found in the xpdf viewer. ...
(Full-Disclosure)
[Full-Disclosure] [USN-64-1] xpdf, CUPS vulnerabilities
... xpdf, cupsys vulnerabilities ... The following packages are affected: ... xpdf-utils). ... A buffer overflow has been found in the xpdf viewer. ...
(Full-Disclosure)
[USN-64-1] xpdf, CUPS vulnerabilities
... xpdf, cupsys vulnerabilities ... The following packages are affected: ... xpdf-utils). ... A buffer overflow has been found in the xpdf viewer. ...
(Bugtraq)