full-disclosure - [ MDVSA-2009:096 ] printer-drivers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 24 Apr 2009 21:36:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:096 ] printer-drivers


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:096
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : printer-drivers
 Date    : April 24, 2009
 Affected: Corporate 3.0
 _______________________________________________________________________

 Problem Description:

 A buffer underflow in Ghostscript's CCITTFax decoding filter allows
 remote attackers to cause denial of service and possibly to execute
 arbitrary by using a crafted PDF file (CVE-2007-6725).
 
 Multiple interger overflows in Ghostsript's International Color
 Consortium Format Library (icclib) allows attackers to cause denial
 of service (heap-based buffer overflow and application crash) and
 possibly execute arbirary code by using either a PostScript or PDF
 file with crafte embedded images (CVE-2009-0583, CVE-2009-0584).
 
 Multiple interger overflows in Ghostsript's International Color
 Consortium Format Library (icclib) allows attackers to cause denial
 of service (heap-based buffer overflow and application crash) and
 possibly execute arbirary code by using either a PostScript or PDF
 file with crafte embedded images. Note: this issue exists because of
 an incomplete fix for CVE-2009-0583 (CVE-2009-0792).
 
 This update provides fixes for that vulnerabilities.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6725
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0583
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0584
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0792
 _______________________________________________________________________

 Updated Packages:

 Corporate 3.0:
 706ec7108aa581ef6360c5dd57d6fef8  corporate/3.0/i586/cups-drivers-1.1-138.6.C30mdk.i586.rpm
 8cf2e4f1bc7fc9480e1a5131ce6d6fd8  corporate/3.0/i586/foomatic-db-3.0.1-0.20040828.1.6.C30mdk.i586.rpm
 820f55b23faf3b3adc5ecf15b6a1effb  corporate/3.0/i586/foomatic-db-engine-3.0.1-0.20040828.1.6.C30mdk.i586.rpm
 e6d2bca4eda8437f3e6bcb200df8a4b0  corporate/3.0/i586/foomatic-filters-3.0.1-0.20040828.1.6.C30mdk.i586.rpm
 85bf1b8588bc1a41d64dee529355b6a8  corporate/3.0/i586/ghostscript-7.07-19.6.C30mdk.i586.rpm
 5499fd1373675166fd0716b620109e05  corporate/3.0/i586/ghostscript-module-X-7.07-19.6.C30mdk.i586.rpm
 c31577d4009fefcf2ad5cd81ed73abb2  corporate/3.0/i586/gimpprint-4.2.7-2.6.C30mdk.i586.rpm
 eb2dae619f3870d83edb58915c136a91  corporate/3.0/i586/libgimpprint1-4.2.7-2.6.C30mdk.i586.rpm
 cb3cf962478cd5425f6e0db89b140ca4  corporate/3.0/i586/libgimpprint1-devel-4.2.7-2.6.C30mdk.i586.rpm
 2be391a6c96f6695f02c62866169b629  corporate/3.0/i586/libijs0-0.34-76.6.C30mdk.i586.rpm
 525984bb729b344e6cff29d91a32de55  corporate/3.0/i586/libijs0-devel-0.34-76.6.C30mdk.i586.rpm
 8f773f830b23dfcfaa0549d3615875f9  corporate/3.0/i586/printer-filters-1.0-138.6.C30mdk.i586.rpm
 1d6940e222ce88bd82f0890202548aae  corporate/3.0/i586/printer-testpages-1.0-138.6.C30mdk.i586.rpm
 5d31d90ac0f83b9f04ce5e0c63a06870  corporate/3.0/i586/printer-utils-1.0-138.6.C30mdk.i586.rpm 
 75a1fdb74d58d7babea2e2879ebc492d  corporate/3.0/SRPMS/printer-drivers-1.0-138.6.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 85fb2f7513829d14c1d7bc86ebe3ea7d  corporate/3.0/x86_64/cups-drivers-1.1-138.6.C30mdk.x86_64.rpm
 8329672f54309d079cd5c4984fdc87a6  corporate/3.0/x86_64/foomatic-db-3.0.1-0.20040828.1.6.C30mdk.x86_64.rpm
 ade5deaf58170868ac6ed1db246d025b  corporate/3.0/x86_64/foomatic-db-engine-3.0.1-0.20040828.1.6.C30mdk.x86_64.rpm
 fc3b45206521d06ffe87909cafffabc0  corporate/3.0/x86_64/foomatic-filters-3.0.1-0.20040828.1.6.C30mdk.x86_64.rpm
 a016e22dd350bf73d4b9340b018ebcef  corporate/3.0/x86_64/ghostscript-7.07-19.6.C30mdk.x86_64.rpm
 ab233942938e0f1d50c147222287be94  corporate/3.0/x86_64/ghostscript-module-X-7.07-19.6.C30mdk.x86_64.rpm
 e6ecdf8fbd14006b5d03153bc44c1d99  corporate/3.0/x86_64/gimpprint-4.2.7-2.6.C30mdk.x86_64.rpm
 4cb06b7a5aa01a897a57a64075e96ee9  corporate/3.0/x86_64/lib64gimpprint1-4.2.7-2.6.C30mdk.x86_64.rpm
 a8745b6bc00c25589b9db5692429de7f  corporate/3.0/x86_64/lib64gimpprint1-devel-4.2.7-2.6.C30mdk.x86_64.rpm
 771c87beea46ef50bdaae832097717ea  corporate/3.0/x86_64/lib64ijs0-0.34-76.6.C30mdk.x86_64.rpm
 d89df67ae159898d114f131587fe56e9  corporate/3.0/x86_64/lib64ijs0-devel-0.34-76.6.C30mdk.x86_64.rpm
 526451f79972a902e8f399fb287d0fed  corporate/3.0/x86_64/printer-filters-1.0-138.6.C30mdk.x86_64.rpm
 875d630e427872a2ce63708fe096f5ed  corporate/3.0/x86_64/printer-testpages-1.0-138.6.C30mdk.x86_64.rpm
 e8e6ffe4d678b95da24f057ff8877ff8  corporate/3.0/x86_64/printer-utils-1.0-138.6.C30mdk.x86_64.rpm 
 75a1fdb74d58d7babea2e2879ebc492d  corporate/3.0/SRPMS/printer-drivers-1.0-138.6.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJ8eoPmqjQ0CJFipgRAserAJ9KzBz1yYYEdFJIiv51Xcp7fGKulwCcCme2
cDKX7jp+hHtb51zIJDE6t6s=
=uEn6
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/