Bug 17281

Summary: cups-filters new security issue CVE-2015-8327
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: normal    
Priority: Normal CC: davidwhodgins, sysadmin-bugs
Version: 5Keywords: validated_update
Target Milestone: ---   
Hardware: i586   
OS: Linux   
URL: http://lwn.net/Vulnerabilities/666731/
Whiteboard: MGA5-64-OK advisory
Source RPM: cups-filters-1.0.71-1.mga5.src.rpm CVE:
Status comment:

Description David Walser 2015-12-03 16:46:09 CET 
Debian has issued an advisory on December 2:
https://www.debian.org/security/2015/dsa-3411

Patched package uploaded for Mageia 5.  This was already fixed in Cauldron.

Advisory:
========================

Updated cups-filters package fixes security vulnerability:

Michal Kowalczyk discovered that missing input sanitising in the foomatic-rip
print filter might result in the execution of arbitrary commands
(CVE-2015-8327).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8327
https://www.debian.org/security/2015/dsa-3411
========================

Updated packages in core/updates_testing:
========================
cups-filters-1.0.71-1.1.mga5
libcups-filters1-1.0.71-1.1.mga5
libcups-filters-devel-1.0.71-1.1.mga5

from cups-filters-1.0.71-1.1.mga5.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 James Kerr 2015-12-04 11:30:51 CET 
On mga5-64

Installed updates from testing:

$ rpm -qa | grep cups-filters
lib64cups-filters1-1.0.71-1.1.mga5
cups-filters-1.0.71-1.1.mga5

Updates installed cleanly. 
My HP printer continues to function normally.

OK for mga5-64

Whiteboard: (none) => MGA5-64-OK

Dave Hodgins 2015-12-05 03:42:50 CET

Keywords: (none) => validated_update
Whiteboard: MGA5-64-OK => MGA5-64-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 2 Mageia Robot 2015-12-05 11:05:10 CET 
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0465.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED