Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Mehrere Probleme in cups
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in cups
ID: MDVSA-2015:108
Distribution: Mandriva
Plattformen: Mandriva Business Server 2.0
Datum: So, 29. März 2015, 13:55
Referenzen: http://advisories.mageia.org/MGASA-2014-0193.html
http://advisories.mageia.org/MGASA-2014-0313.html
http://advisories.mageia.org/MGASA-2015-0067.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679

Originalnachricht

This is a multi-part message in MIME format...

------------=_1427618191-10360-8

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:108
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : cups
Date : March 29, 2015
Affected: Business Server 2.0
_______________________________________________________________________

Problem Description:

Updated cups packages fix security vulnerabilities:

Cross-site scripting (XSS) vulnerability in scheduler/client.c
in Common Unix Printing System (CUPS) before 1.7.2 allows remote
attackers to inject arbitrary web script or HTML via the URL path,
related to the is_path_absolute function (CVE-2014-2856).

In CUPS before 1.7.4, a local user with privileges of group=lp
can write symbolic links in the rss directory and use that to gain
'@SYSTEM' group privilege with cupsd (CVE-2014-3537).

It was discovered that the web interface in CUPS incorrectly
validated permissions on rss files and directory index files. A local
attacker could possibly use this issue to bypass file permissions
and read arbitrary files, possibly leading to a privilege escalation
(CVE-2014-5029, CVE-2014-5030, CVE-2014-5031).

A malformed file with an invalid page header and compressed raster data
can trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679
http://advisories.mageia.org/MGASA-2014-0193.html
http://advisories.mageia.org/MGASA-2014-0313.html
http://advisories.mageia.org/MGASA-2015-0067.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 2/X86_64:
0d1f31885b6c118b63449f2fdd821666 mbs2/x86_64/cups-1.7.0-8.1.mbs2.x86_64.rpm
b5337600a386f902763653796a2cefdf
mbs2/x86_64/cups-common-1.7.0-8.1.mbs2.x86_64.rpm
7b1513d85b5f22cd90bed23a35e44f51
mbs2/x86_64/cups-filesystem-1.7.0-8.1.mbs2.noarch.rpm
c25fa9b9bba101274984fa2b7a62f7a3
mbs2/x86_64/lib64cups2-1.7.0-8.1.mbs2.x86_64.rpm
df24a6b84fdafffaadf961ab4aa3640b
mbs2/x86_64/lib64cups2-devel-1.7.0-8.1.mbs2.x86_64.rpm
5c172624c992de8ebb2bf8a2b232ee3a mbs2/SRPMS/cups-1.7.0-8.1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVF6q1mqjQ0CJFipgRAuxXAKDq8A/WlNzp54yRN7xnKy8ZBaRZQwCfSAh0
n7hHPzmYVzh2wFP6PffIl0E=
=ykhv
-----END PGP SIGNATURE-----


------------=_1427618191-10360-8
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1427618191-10360-8--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung