bugtraq - [ MDVSA-2014:092 ] cups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1WlH5M-00038T-VP@titan.mandriva.com>
Date: Fri, 16 May 2014 14:18:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2014:092 ] cups

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:092
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : cups
 Date    : May 16, 2014
 Affected: Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in cups:
 
 lppasswd in CUPS before 1.7.1, when running with setuid privileges,
 allows local users to read portions of arbitrary files via a
 modified HOME environment variable and a symlink attack involving
 .cups/client.conf (CVE-2013-6891).
 
 Cross-site scripting (XSS) vulnerability in scheduler/client.c
 in Common Unix Printing System (CUPS) before 1.7.2 allows remote
 attackers to inject arbitrary web script or HTML via the URL path,
 related to the is_path_absolute function (CVE-2014-2856).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6891
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 8143b2a3b767ee960c28f10516d55d2a  mes5/i586/cups-1.3.10-0.7mdvmes5.2.i586.rpm
 bc9a8e5908dc217cb7e985dcaa090948  mes5/i586/cups-common-1.3.10-0.7mdvmes5.2.i586.rpm
 64176366b00b7c3e7f7f35f35aafe26d  mes5/i586/cups-serial-1.3.10-0.7mdvmes5.2.i586.rpm
 c4926d589017411ae66815746ee6c6ba  mes5/i586/libcups2-1.3.10-0.7mdvmes5.2.i586.rpm
 2e2ba1cd0bfa7dcd21276255ff4d747c  mes5/i586/libcups2-devel-1.3.10-0.7mdvmes5.2.i586.rpm
 5171a744370db45781755f21d3f56f7c  mes5/i586/php-cups-1.3.10-0.7mdvmes5.2.i586.rpm 
 1658bb3253e9d923361e9a078be83a5b  mes5/SRPMS/cups-1.3.10-0.7mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 9030814a190e5e1892e9a0d08e88f645  mes5/x86_64/cups-1.3.10-0.7mdvmes5.2.x86_64.rpm
 27119afd41865890903bf904130ee425  mes5/x86_64/cups-common-1.3.10-0.7mdvmes5.2.x86_64.rpm
 e9bdae3ea58237d04e1b0696bc792113  mes5/x86_64/cups-serial-1.3.10-0.7mdvmes5.2.x86_64.rpm
 cae11ff7c5eac9fdd9716526dbcb179d  mes5/x86_64/lib64cups2-1.3.10-0.7mdvmes5.2.x86_64.rpm
 91bbc04883ddcf7c1b7e4f9609a81fd6  mes5/x86_64/lib64cups2-devel-1.3.10-0.7mdvmes5.2.x86_64.rpm
 160961b924ac72272951552d3641a7ec  mes5/x86_64/php-cups-1.3.10-0.7mdvmes5.2.x86_64.rpm 
 1658bb3253e9d923361e9a078be83a5b  mes5/SRPMS/cups-1.3.10-0.7mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTddX2mqjQ0CJFipgRAtgAAKCXOPqgzFuMZiQtBTaVqF1CQ+qspACfRw2C
GRomzZDVSFilfqhmbpIJHDU=
=ZAUC
-----END PGP SIGNATURE-----