[ MDVSA-2011:147 ] cups



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:147
http://www.mandriva.com/security/
_______________________________________________________________________

Package : cups
Date : October 11, 2011
Affected: 2011.
_______________________________________________________________________

Problem Description:

A vulnerability has been discovered and corrected in cups:

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896 (CVE-2011-3170).

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3170
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2011:
dfe1930514d61aed854a4e8008c7c96b 2011/i586/cups-1.4.8-2.1-mdv2011.0.i586.rpm
507a139bb70c7a9b5ecb42bb53651ea0 2011/i586/cups-common-1.4.8-2.1-mdv2011.0.i586.rpm
9c6a22dae7caae2a6d6809875b4b8b40 2011/i586/cups-serial-1.4.8-2.1-mdv2011.0.i586.rpm
2d2c112a5af50f542aeee9b1834a1fa9 2011/i586/libcups2-1.4.8-2.1-mdv2011.0.i586.rpm
ad6720b4d527f55d68fe09f97044efde 2011/i586/libcups2-devel-1.4.8-2.1-mdv2011.0.i586.rpm
066d648e963f65fd933dcfaa270b3611 2011/i586/php-cups-1.4.8-2.1-mdv2011.0.i586.rpm
2db28d333fbe983d011892d3e00ca1b4 2011/SRPMS/cups-1.4.8-2.1.src.rpm

Mandriva Linux 2011/X86_64:
f1bbdb67e1ede1101c2f9910d4c83e81 2011/x86_64/cups-1.4.8-2.1-mdv2011.0.x86_64.rpm
33ac2f328ee85dd762ce75e268a2b120 2011/x86_64/cups-common-1.4.8-2.1-mdv2011.0.x86_64.rpm
1cf119819652ce5b3146f4726e0fb84e 2011/x86_64/cups-serial-1.4.8-2.1-mdv2011.0.x86_64.rpm
d3e364709febbc4c40ad40f623eb8e7a 2011/x86_64/lib64cups2-1.4.8-2.1-mdv2011.0.x86_64.rpm
3275cf6d769e5393aed0b7c1edf947c7 2011/x86_64/lib64cups2-devel-1.4.8-2.1-mdv2011.0.x86_64.rpm
34851a451a10fcce01e70f83fe1c7e67 2011/x86_64/php-cups-1.4.8-2.1-mdv2011.0.x86_64.rpm
2db28d333fbe983d011892d3e00ca1b4 2011/SRPMS/cups-1.4.8-2.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOkt8bmqjQ0CJFipgRAlyPAKDsHE0QPOSeXCNqrRsmacPFlv88tgCg9LkA
shkRyUMrLntE6PqX40zPI2A=
=G4RG
-----END PGP SIGNATURE-----



Relevant Pages