Skip to navigation

Security Advisory Important: cups security update

Advisory: RHSA-2007:1023-2
Type: Security Advisory
Severity: Important
Issued on: 2007-11-07
Last updated on: 2007-11-07
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
CVEs (cve.mitre.org): CVE-2007-4045
CVE-2007-4351
CVE-2007-5393

Details

Updated cups packages that fix several security issues are now available
for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer
for UNIX(R) operating systems.

Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker
could create a malicious PDF file that would cause CUPS to crash or
potentially execute arbitrary code when printed. (CVE-2007-5393)

Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags.
A remote attacker who is able to connect to the IPP TCP port could send a
malicious request causing the CUPS daemon to crash. (CVE-2007-4351)

A flaw was found in the way CUPS handled SSL negotiation. A remote attacker
capable of connecting to the CUPS daemon could cause CUPS to crash.
(CVE-2007-4045)

All CUPS users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Desktop (v. 3)

SRPMS:
cups-1.1.17-13.3.46.src.rpm
File outdated by:  RHSA-2010:0754
    MD5: a09f89cd409ee521a73c4a7b0d72e29b
 
IA-32:
cups-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: f55403eca3a9567f06d4f7c23c306aa5
cups-devel-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 0367f3b029e7d2e19026c5de170cc1c1
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
 
x86_64:
cups-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: ae11cae5bf269e1d1169bf7c60325632
cups-devel-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7a31caefcfee7a387703847925345593
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 77db48d6d4d4fbe4f7d510384118d62b
 
Red Hat Enterprise Linux AS (v. 3)

SRPMS:
cups-1.1.17-13.3.46.src.rpm
File outdated by:  RHSA-2010:0754
    MD5: a09f89cd409ee521a73c4a7b0d72e29b
 
IA-32:
cups-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: f55403eca3a9567f06d4f7c23c306aa5
cups-devel-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 0367f3b029e7d2e19026c5de170cc1c1
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
 
IA-64:
cups-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7f71acf2fa6ed3293093d702db16d41f
cups-devel-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 981c9e9d29f188c76f23d517223b62b6
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 9eb3353013c45f36f51898546d6449cb
 
PPC:
cups-1.1.17-13.3.46.ppc.rpm
File outdated by:  RHSA-2010:0754
    MD5: 2867471d07abf916a09661e210452eb5
cups-devel-1.1.17-13.3.46.ppc.rpm
File outdated by:  RHSA-2010:0754
    MD5: e9bea7b8a5fbc22c61a6c418d1eb78a2
cups-libs-1.1.17-13.3.46.ppc.rpm
File outdated by:  RHSA-2010:0754
    MD5: 47bfa96ebf919d2d5fb674385567804d
cups-libs-1.1.17-13.3.46.ppc64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 0995e9aa0e95656b2db64b9488dafae3
 
s390:
cups-1.1.17-13.3.46.s390.rpm
File outdated by:  RHSA-2010:0754
    MD5: d89b822fd9c6785cc65716569750ef66
cups-devel-1.1.17-13.3.46.s390.rpm
File outdated by:  RHSA-2010:0754
    MD5: 728e5f195fef201ebce131f1e02b5cc9
cups-libs-1.1.17-13.3.46.s390.rpm
File outdated by:  RHSA-2010:0754
    MD5: d6127b0b5a9854292ca57958363ce74c
 
s390x:
cups-1.1.17-13.3.46.s390x.rpm
File outdated by:  RHSA-2010:0754
    MD5: 80a32a8329e423361fb417200427f2de
cups-devel-1.1.17-13.3.46.s390x.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6a178fff3a8264aa22e010491ee70cab
cups-libs-1.1.17-13.3.46.s390.rpm
File outdated by:  RHSA-2010:0754
    MD5: d6127b0b5a9854292ca57958363ce74c
cups-libs-1.1.17-13.3.46.s390x.rpm
File outdated by:  RHSA-2010:0754
    MD5: 5521921be20a245d605c4e85b325163a
 
x86_64:
cups-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: ae11cae5bf269e1d1169bf7c60325632
cups-devel-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7a31caefcfee7a387703847925345593
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 77db48d6d4d4fbe4f7d510384118d62b
 
Red Hat Enterprise Linux ES (v. 3)

SRPMS:
cups-1.1.17-13.3.46.src.rpm
File outdated by:  RHSA-2010:0754
    MD5: a09f89cd409ee521a73c4a7b0d72e29b
 
IA-32:
cups-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: f55403eca3a9567f06d4f7c23c306aa5
cups-devel-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 0367f3b029e7d2e19026c5de170cc1c1
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
 
IA-64:
cups-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7f71acf2fa6ed3293093d702db16d41f
cups-devel-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 981c9e9d29f188c76f23d517223b62b6
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 9eb3353013c45f36f51898546d6449cb
 
x86_64:
cups-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: ae11cae5bf269e1d1169bf7c60325632
cups-devel-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7a31caefcfee7a387703847925345593
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 77db48d6d4d4fbe4f7d510384118d62b
 
Red Hat Enterprise Linux WS (v. 3)

SRPMS:
cups-1.1.17-13.3.46.src.rpm
File outdated by:  RHSA-2010:0754
    MD5: a09f89cd409ee521a73c4a7b0d72e29b
 
IA-32:
cups-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: f55403eca3a9567f06d4f7c23c306aa5
cups-devel-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 0367f3b029e7d2e19026c5de170cc1c1
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
 
IA-64:
cups-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7f71acf2fa6ed3293093d702db16d41f
cups-devel-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 981c9e9d29f188c76f23d517223b62b6
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.ia64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 9eb3353013c45f36f51898546d6449cb
 
x86_64:
cups-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: ae11cae5bf269e1d1169bf7c60325632
cups-devel-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 7a31caefcfee7a387703847925345593
cups-libs-1.1.17-13.3.46.i386.rpm
File outdated by:  RHSA-2010:0754
    MD5: 6ac644913a17a1ad25d4e9a2cc22067b
cups-libs-1.1.17-13.3.46.x86_64.rpm
File outdated by:  RHSA-2010:0754
    MD5: 77db48d6d4d4fbe4f7d510384118d62b
 

Bugs fixed (see bugzilla for more information)

250161 - CVE-2007-4045 Incomplete fix for CVE-2007-0720 CUPS denial of service
345091 - CVE-2007-4351 cups boundary error
345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar()


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/