Bug 15260 - cups new security issue fixed upstream in 2.0.2 (CVE-2014-9679)
Summary: cups new security issue fixed upstream in 2.0.2 (CVE-2014-9679)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/633546/
Whiteboard: advisory mga4-32-ok mga4-64-ok
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-02-10 22:04 CET by David Walser
Modified: 2015-02-17 15:42 CET (History)
2 users (show)

See Also:
Source RPM: cups-2.0.1-3.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2015-02-10 22:04:36 CET
CUPS 2.0.2 has been announced on February 9:
https://www.cups.org/blog.php?L738

It fixes one security issue:
https://www.cups.org/str.php?L4551

The patch to fix it is attached there.  It's not immediately clear from the report of Mageia 4 is affected (will have to check the patch).

A CVE has been requested for this:
http://openwall.com/lists/oss-security/2015/02/10/15

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2015-02-12 18:17:18 CET
This has been assigned CVE-2014-9679:
http://openwall.com/lists/oss-security/2015/02/12/12

Summary: cups new security issue fixed upstream in 2.0.2 => cups new security issue fixed upstream in 2.0.2 (CVE-2014-9679)

Comment 2 David Walser 2015-02-12 18:49:37 CET
Fixed in cups-2.0.2-1.mga5 by Thierry.  Thanks Thierry!

I confirmed the issue is present in 1.7.0 also.

Patched package uploaded for Mageia 4.

Advisory:
========================

Updated cups packages fix security vulnerability:

A malformed file with an invalid page header and compressed raster data can
trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679
https://www.cups.org/str.php?L4551
http://openwall.com/lists/oss-security/2015/02/12/12
========================

Updated packages in core/updates_testing:
========================
cups-1.7.0-7.4.mga4
cups-common-1.7.0-7.4.mga4
libcups2-devel-1.7.0-7.4.mga4
libcups2-1.7.0-7.4.mga4
cups-filesystem-1.7.0-7.4.mga4

from cups-1.7.0-7.4.mga4.src.rpm

CC: (none) => thierry.vignaud
Version: Cauldron => 4
Assignee: thierry.vignaud => qa-bugs

Comment 3 claire robinson 2015-02-13 13:46:56 CET
Performed two installations one x86_64 and one i586 with kernel, 3 x nvidia, fglrx, broadcom-wl, vbox, xtables-addons and also glibc, dbus, x11 and cups at the same time. 

Printing tested with hp and canon printers. Printers configured, shared etc.

All Ok

Whiteboard: (none) => mga4-32-ok mga4-64-ok

Comment 4 claire robinson 2015-02-13 19:14:46 CET
Advisory uploaded.

Whiteboard: mga4-32-ok mga4-64-ok => advisory mga4-32-ok mga4-64-ok

claire robinson 2015-02-13 19:25:14 CET

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 claire robinson 2015-02-13 19:25:46 CET
Validating. Please push to 4 updates
Comment 6 Mageia Robot 2015-02-15 16:57:55 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0067.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2015-02-17 15:42:54 CET

URL: (none) => http://lwn.net/Vulnerabilities/633546/


Note You need to log in before you can comment on or make changes to this bug.