-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2006:010 http://www.mandriva.com/security/ _______________________________________________________________________ Package : cups Date : January 10, 2006 Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0 _______________________________________________________________________ Problem Description: Multiple heap-based buffer overflows in the DCTStream::readProgressiveSOF and DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, allow user-complicit attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index. (CVE-2005-3191) Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01 allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field. (CVE-2005-3192) Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier allows user-complicit attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated. (CVE-2005-3193) An additional patch re-addresses memory allocation routines in goo/gmem.c (Martin Pitt/Canonical, Dirk Mueller/KDE). In addition, Chris Evans discovered several other vulnerbilities in the xpdf code base: Out-of-bounds heap accesses with large or negative parameters to "FlateDecode" stream. (CVE-2005-3192) Out-of-bounds heap accesses with large or negative parameters to "CCITTFaxDecode" stream. (CVE-2005-3624) Infinite CPU spins in various places when stream ends unexpectedly. (CVE-2005-3625) NULL pointer crash in the "FlateDecode" stream. (CVE-2005-3626) Overflows of compInfo array in "DCTDecode" stream. (CVE-2005-3627) Possible to use index past end of array in "DCTDecode" stream. (CVE-2005-3627) Possible out-of-bounds indexing trouble in "DCTDecode" stream. (CVE-2005-3627) CUPS uses an embedded copy of the xpdf code, with the same vulnerabilities. The updated packages have been patched to correct these problems. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3192 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3625 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3628 _______________________________________________________________________ Updated Packages: Mandriva Linux 10.1: b5c52be00b23507bcd130c9e7d1ddd50 10.1/RPMS/cups-1.1.21-0.rc1.7.8.101mdk.i586.rpm 3c98e0ba4a584ca32a2a25eb20b33a39 10.1/RPMS/cups-common-1.1.21-0.rc1.7.8.101mdk.i586.rpm 1fe768077621d37fa855f51baeecd414 10.1/RPMS/cups-serial-1.1.21-0.rc1.7.8.101mdk.i586.rpm 4d8cc497b444ef413726f305af275a6a 10.1/RPMS/libcups2-1.1.21-0.rc1.7.8.101mdk.i586.rpm a4d621ee0eccb8f95791b991fac95768 10.1/RPMS/libcups2-devel-1.1.21-0.rc1.7.8.101mdk.i586.rpm 7e0e073cfdd7c43d255aa80ed37c28d1 10.1/SRPMS/cups-1.1.21-0.rc1.7.8.101mdk.src.rpm Mandriva Linux 10.1/X86_64: c782703a80182ba0f194a3fe59e29671 x86_64/10.1/RPMS/cups-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm 77ddacf0c0a0e327190ff86c797a7eb3 x86_64/10.1/RPMS/cups-common-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm 88f6f078e7bdf537359b12df1b116875 x86_64/10.1/RPMS/cups-serial-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm bba6774180d2f868f962f8ea8b6e0e51 x86_64/10.1/RPMS/lib64cups2-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm 9cc3515dc6a6655e89a492a3664cea67 x86_64/10.1/RPMS/lib64cups2-devel-1.1.21-0.rc1.7.8.101mdk.x86_64.rpm 7e0e073cfdd7c43d255aa80ed37c28d1 x86_64/10.1/SRPMS/cups-1.1.21-0.rc1.7.8.101mdk.src.rpm Mandriva Linux 10.2: 5765c4454d6295a4a7cfc6eeeca70c77 10.2/RPMS/cups-1.1.23-11.2.102mdk.i586.rpm d18d807072f5cc3d1c4ef98a2cf911ab 10.2/RPMS/cups-common-1.1.23-11.2.102mdk.i586.rpm ef4f68b6a7b2201abd2bb3c70fe296be 10.2/RPMS/cups-serial-1.1.23-11.2.102mdk.i586.rpm 29ae7290946944562087a0191142e9cc 10.2/RPMS/libcups2-1.1.23-11.2.102mdk.i586.rpm a853346dc6688da93a3231d12c1728f6 10.2/RPMS/libcups2-devel-1.1.23-11.2.102mdk.i586.rpm 5862692ff8114c7f78a808e946c371e6 10.2/SRPMS/cups-1.1.23-11.2.102mdk.src.rpm Mandriva Linux 10.2/X86_64: 9d2e1052c4aeb7f6aad3e0d3c60f85d8 x86_64/10.2/RPMS/cups-1.1.23-11.2.102mdk.x86_64.rpm 8dfe2e759e0749cf7b7acdf077fab2e8 x86_64/10.2/RPMS/cups-common-1.1.23-11.2.102mdk.x86_64.rpm 0ae798ff3cad9bf639db492d3717ff99 x86_64/10.2/RPMS/cups-serial-1.1.23-11.2.102mdk.x86_64.rpm b85e0f3831dae734217d76930813909b x86_64/10.2/RPMS/lib64cups2-1.1.23-11.2.102mdk.x86_64.rpm 38f5140a72acf7689b599bef9f923000 x86_64/10.2/RPMS/lib64cups2-devel-1.1.23-11.2.102mdk.x86_64.rpm 5862692ff8114c7f78a808e946c371e6 x86_64/10.2/SRPMS/cups-1.1.23-11.2.102mdk.src.rpm Mandriva Linux 2006.0: 7fa2fe8c6e545eb18fd69f037688d701 2006.0/RPMS/cups-1.1.23-17.1.20060mdk.i586.rpm 045c02e7fe8e5c5a7c19710170892847 2006.0/RPMS/cups-common-1.1.23-17.1.20060mdk.i586.rpm d0246199b3ca4cb26e91490fd85994f4 2006.0/RPMS/cups-serial-1.1.23-17.1.20060mdk.i586.rpm f8b9623d2d7a925196c3496c6f8c491d 2006.0/RPMS/libcups2-1.1.23-17.1.20060mdk.i586.rpm dca5e3b78ef5941f8f6880197e7c02c0 2006.0/RPMS/libcups2-devel-1.1.23-17.1.20060mdk.i586.rpm f54c5483e511e5f94706d25d04b9bed7 2006.0/SRPMS/cups-1.1.23-17.1.20060mdk.src.rpm Mandriva Linux 2006.0/X86_64: 2f3de58ff175a564fe4949538632af96 x86_64/2006.0/RPMS/cups-1.1.23-17.1.20060mdk.x86_64.rpm f411ec48c957768194cde193e5693a9e x86_64/2006.0/RPMS/cups-common-1.1.23-17.1.20060mdk.x86_64.rpm 4ca9fcdc1d9c90c0d00cb5ba4c80ad06 x86_64/2006.0/RPMS/cups-serial-1.1.23-17.1.20060mdk.x86_64.rpm c869457a90e4113d284730074dfa8b4e x86_64/2006.0/RPMS/lib64cups2-1.1.23-17.1.20060mdk.x86_64.rpm 98f854ccb1cff62ac98c70213d9da0f8 x86_64/2006.0/RPMS/lib64cups2-devel-1.1.23-17.1.20060mdk.x86_64.rpm f54c5483e511e5f94706d25d04b9bed7 x86_64/2006.0/SRPMS/cups-1.1.23-17.1.20060mdk.src.rpm Corporate Server 2.1: 3a4a7fadc8472a8b9df603d06173a12b corporate/2.1/RPMS/cups-1.1.18-2.12.C21mdk.i586.rpm 8142c0e40cac5993bf87b20867403225 corporate/2.1/RPMS/cups-common-1.1.18-2.12.C21mdk.i586.rpm a4246d3a163aad65368ad436ee271d3d corporate/2.1/RPMS/cups-serial-1.1.18-2.12.C21mdk.i586.rpm 61e710d2dbd5c3b24980a3aee8027609 corporate/2.1/RPMS/libcups1-1.1.18-2.12.C21mdk.i586.rpm 26b64c12e3b8b48e214fd7070f547879 corporate/2.1/RPMS/libcups1-devel-1.1.18-2.12.C21mdk.i586.rpm 06625c0147c5e2aaebd3575ed0133e6b corporate/2.1/SRPMS/cups-1.1.18-2.12.C21mdk.src.rpm Corporate Server 2.1/X86_64: fd0907a5db87cc55f999f05183866f4e x86_64/corporate/2.1/RPMS/cups-1.1.18-2.12.C21mdk.x86_64.rpm 7fb05a22ddee7df584552964b3c29d77 x86_64/corporate/2.1/RPMS/cups-common-1.1.18-2.12.C21mdk.x86_64.rpm bf0863a6b7616e34678b6866e2c4d6df x86_64/corporate/2.1/RPMS/cups-serial-1.1.18-2.12.C21mdk.x86_64.rpm d3925af3dc401c15a7d5a5da02b7469b x86_64/corporate/2.1/RPMS/libcups1-1.1.18-2.12.C21mdk.x86_64.rpm fdc4cdf8756b835b28b6e6d6945914e4 x86_64/corporate/2.1/RPMS/libcups1-devel-1.1.18-2.12.C21mdk.x86_64.rpm 06625c0147c5e2aaebd3575ed0133e6b x86_64/corporate/2.1/SRPMS/cups-1.1.18-2.12.C21mdk.src.rpm Corporate 3.0: 18480c0d569725ed5f5542a6e118e01a corporate/3.0/RPMS/cups-1.1.20-5.10.C30mdk.i586.rpm 41eed97b13410174f82c85e43b2b9c9f corporate/3.0/RPMS/cups-common-1.1.20-5.10.C30mdk.i586.rpm c371b67e6315faae8afcd686a5f1affb corporate/3.0/RPMS/cups-serial-1.1.20-5.10.C30mdk.i586.rpm 43f1a46effe9a488642fbe7ba7932477 corporate/3.0/RPMS/libcups2-1.1.20-5.10.C30mdk.i586.rpm da7a75b3e56a8ad8812bd88e078c4567 corporate/3.0/RPMS/libcups2-devel-1.1.20-5.10.C30mdk.i586.rpm 9540dbf56f41e2f77d573ca2798cf306 corporate/3.0/SRPMS/cups-1.1.20-5.10.C30mdk.src.rpm Corporate 3.0/X86_64: fe95777cc7bdfd4b41daf4f9a19186c9 x86_64/corporate/3.0/RPMS/cups-1.1.20-5.10.C30mdk.x86_64.rpm 5e56191f8f14638ab5304ac94df6bb7a x86_64/corporate/3.0/RPMS/cups-common-1.1.20-5.10.C30mdk.x86_64.rpm 20f1396cf173d3b58d2a1dc4068770d4 x86_64/corporate/3.0/RPMS/cups-serial-1.1.20-5.10.C30mdk.x86_64.rpm 6da98153e198cd3b2456280feae5bdba x86_64/corporate/3.0/RPMS/lib64cups2-1.1.20-5.10.C30mdk.x86_64.rpm 83d2c68c0180d8ba395bc9c0cb8b1338 x86_64/corporate/3.0/RPMS/lib64cups2-devel-1.1.20-5.10.C30mdk.x86_64.rpm 9540dbf56f41e2f77d573ca2798cf306 x86_64/corporate/3.0/SRPMS/cups-1.1.20-5.10.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFDxCNYmqjQ0CJFipgRAl+eAKDi8lnQXk0D+rUq4UvAl5Le1Ze5oQCfUw+7 D4xxg7GHFovst9LlQsfydIs= =0UJn -----END PGP SIGNATURE-----
