| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050119110053.GA20881@box79162.elkhouse.de>
From: martin.pitt at canonical.com (Martin Pitt)
Subject: [USN-64-1] xpdf, CUPS vulnerabilities
===========================================================
Ubuntu Security Notice USN-64-1 January 19, 2005
xpdf, cupsys vulnerabilities
CAN-2005-0064
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
The following packages are affected:
cupsys
libcupsimage2
libcupsys2-gnutls10
xpdf-reader
xpdf-utils
The problem can be corrected by upgrading the affected package to
version 1.1.20final+cvs20040330-4ubuntu16.4 (cupsys, libcupsimage2,
and libcupsys2-gnutls10) and 3.00-8ubuntu1.4 (xpdf-reader and
xpdf-utils). In general, a standard system upgrade is sufficient to
effect the necessary changes.
Details follow:
A buffer overflow has been found in the xpdf viewer. An insufficient
input validation of the encryption key length could be exploited by an
attacker providing a specially crafted PDF file which, when processed
by xpdf, could result in abnormal program termination or the execution
of attacker supplied program code with the user's privileges.
The Common UNIX Printing System (CUPS) uses the same code to print PDF
files. In this case, this bug could be exploited to gain the
privileges of the CUPS print server (by default, user cupsys).
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4.diff.gz
Size/MD5: 1353321 5877c65f6d8f858ae9e176be9ef6410d
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4.dsc
Size/MD5: 867 7a5091f1718ccc0e56b655fb01b8057e
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330.orig.tar.gz
Size/MD5: 5645146 5eb5983a71b26e4af841c26703fc2f79
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00-8ubuntu1.4.diff.gz
Size/MD5: 47899 cbcf2ab245afbabd90086b1022ce65f2
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00-8ubuntu1.4.dsc
Size/MD5: 788 b4eb7934f273cd445ffe844242ba3e0c
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00.orig.tar.gz
Size/MD5: 534697 95294cef3031dd68e65f331e8750b2c2
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-common_3.00-8ubuntu1.4_all.deb
Size/MD5: 56410 0f635571ea692f043fdbf3c2e1831253
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf_3.00-8ubuntu1.4_all.deb
Size/MD5: 1274 300fa460fc04629eee23c0b4b9447fd7
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys-bsd_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 58900 31f791a66c7d1404e04392b75760ba8e
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys-client_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 107172 d68ff02919de67e873cd8a606c748855
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 3614588 e70e1a779b79268a9890a650d1dee919
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsimage2-dev_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 62546 d0e5bb648e62183786cbc75dce29edbe
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsimage2_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 53208 3fbb37717ad9ac9e9795f3a2b5ff8bc1
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsys2-dev_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 101676 f85c589f51c1aa70c019b31e152ba003
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsys2-gnutls10_1.1.20final+cvs20040330-4ubuntu16.4_amd64.deb
Size/MD5: 74738 7edd4f3093e35376a85d505cf4a3f050
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-reader_3.00-8ubuntu1.4_amd64.deb
Size/MD5: 666728 adda9e02ae08bb46029d6f1393fca20a
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-utils_3.00-8ubuntu1.4_amd64.deb
Size/MD5: 1270714 5cd25cc5661e99247ba0af7bcf31297f
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys-bsd_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 58254 ad8a1dac7aa1dfb6cfff1bde76948f33
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys-client_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 104976 07e0832f69d47703c382038ef85395ff
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 3603284 1b986defe60c5e32b99ff2d0be58ea26
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsimage2-dev_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 62126 70f6bdf50c1ea545e8bd573b375ae863
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsimage2_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 52792 1ed36a6f187d3262e1d7fb575ed8f872
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsys2-dev_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 98336 47854bc25adefebae9a5e1826dcd1b1a
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsys2-gnutls10_1.1.20final+cvs20040330-4ubuntu16.4_i386.deb
Size/MD5: 72012 2bba044150c4527dc11692b27f293755
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-reader_3.00-8ubuntu1.4_i386.deb
Size/MD5: 631720 706726bf857936af30380b07c72d6dd5
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-utils_3.00-8ubuntu1.4_i386.deb
Size/MD5: 1193210 34ae871124763656ac7e21c32612e511
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys-bsd_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 62844 e2b936306040808fef0bd3fe2590d981
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys-client_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 114812 1d78506eed2c9e352b861d6ba757cc6b
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/cupsys_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 3633666 95463d6cc9b4082f245bea30b0462964
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsimage2-dev_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 61738 5e6ae8a2b9d188ec901c17f851212530
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsimage2_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 55432 714a7305c6a79feb99e2d939d206033d
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsys2-dev_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 101060 1c99fe289c0c5d046da10001842a6da2
http://security.ubuntu.com/ubuntu/pool/main/c/cupsys/libcupsys2-gnutls10_1.1.20final+cvs20040330-4ubuntu16.4_powerpc.deb
Size/MD5: 74834 7f1db6e2634579c504657b6162099db0
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-reader_3.00-8ubuntu1.4_powerpc.deb
Size/MD5: 692876 f4b9b29c7c8ad9a8fb5a3d6dd332a776
http://security.ubuntu.com/ubuntu/pool/main/x/xpdf/xpdf-utils_3.00-8ubuntu1.4_powerpc.deb
Size/MD5: 1310912 b472d87db41d4ad4771cece71a55b7c5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050119/17f0358f/attachment.bin
Powered by blists - more mailing lists