Bug 15260

Summary:	cups new security issue fixed upstream in 2.0.2 (CVE-2014-9679)
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	sysadmin-bugs, thierry.vignaud
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/633546/
Whiteboard:	advisory mga4-32-ok mga4-64-ok
Source RPM:	cups-2.0.1-3.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2015-02-10 22:04:36 CET

CUPS 2.0.2 has been announced on February 9:
https://www.cups.org/blog.php?L738

It fixes one security issue:
https://www.cups.org/str.php?L4551

The patch to fix it is attached there.  It's not immediately clear from the report of Mageia 4 is affected (will have to check the patch).

A CVE has been requested for this:
http://openwall.com/lists/oss-security/2015/02/10/15

Reproducible: 

Steps to Reproduce:

Comment 1 David Walser 2015-02-12 18:17:18 CET

This has been assigned CVE-2014-9679:
http://openwall.com/lists/oss-security/2015/02/12/12

Summary: cups new security issue fixed upstream in 2.0.2 => cups new security issue fixed upstream in 2.0.2 (CVE-2014-9679)

Comment 2 David Walser 2015-02-12 18:49:37 CET

Fixed in cups-2.0.2-1.mga5 by Thierry.  Thanks Thierry!

I confirmed the issue is present in 1.7.0 also.

Patched package uploaded for Mageia 4.

Advisory:
========================

Updated cups packages fix security vulnerability:

A malformed file with an invalid page header and compressed raster data can
trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679
https://www.cups.org/str.php?L4551
http://openwall.com/lists/oss-security/2015/02/12/12
========================

Updated packages in core/updates_testing:
========================
cups-1.7.0-7.4.mga4
cups-common-1.7.0-7.4.mga4
libcups2-devel-1.7.0-7.4.mga4
libcups2-1.7.0-7.4.mga4
cups-filesystem-1.7.0-7.4.mga4

from cups-1.7.0-7.4.mga4.src.rpm

CC: (none) => thierry.vignaud
Version: Cauldron => 4
Assignee: thierry.vignaud => qa-bugs

Comment 3 claire robinson 2015-02-13 13:46:56 CET

Performed two installations one x86_64 and one i586 with kernel, 3 x nvidia, fglrx, broadcom-wl, vbox, xtables-addons and also glibc, dbus, x11 and cups at the same time. 

Printing tested with hp and canon printers. Printers configured, shared etc.

All Ok

Whiteboard: (none) => mga4-32-ok mga4-64-ok

Comment 4 claire robinson 2015-02-13 19:14:46 CET

Advisory uploaded.

Whiteboard: mga4-32-ok mga4-64-ok => advisory mga4-32-ok mga4-64-ok

claire robinson 2015-02-13 19:25:14 CET

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 claire robinson 2015-02-13 19:25:46 CET

Validating. Please push to 4 updates

Comment 6 Mageia Robot 2015-02-15 16:57:55 CET

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0067.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2015-02-17 15:42:54 CET

URL: (none) => http://lwn.net/Vulnerabilities/633546/