Bug 2714 - Update candidate: hplip (fixes upgrade problem from Mandriva)
Summary: Update candidate: hplip (fixes upgrade problem from Mandriva)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 1
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard:
Keywords: Security, validated_update
Depends on:
Blocks:
 
Reported: 2011-09-12 13:13 CEST by Florian Hubold
Modified: 2011-09-18 02:52 CEST (History)
11 users (show)

See Also:
Source RPM:
CVE:
Status comment:


Attachments

Description Florian Hubold 2011-09-12 13:13:46 CEST
There is now hplip-3.11.7-1.1.mga1 in core/updates_testing to validate


Suggested advisory:
-------------------
This update addresses the folloving CVEs:

- CVE-2011-2722

A temporary file handling flaw was reported [1] in prnt/hpijs/hpcupsfax.cpp,
the hplip HP CUPS filter.  Because a predicatable temporary filename is used
(/tmp/hpcupsfax.out), an attacker could use a symlink attack to overwrite an
arbitrary file with the privileges of the process running the HP CUPS fax
filter.

[1] https://bugzilla.novell.com/show_bug.cgi?id=704608

Other fixes in this release:

- added Requires on wget to avoid misleading errors about network connectivity
- added Device ID for HP LaserJet Professional P1606dn

hplip-3.11.7 adds support for the following printers:

- HP DeskJet 3050A J611 series
- HP LaserJet 100 Color MFP M175
- HP LaserJet Professional M1216nfh MFP
- HP LaserJet Professional M1219nf MFP

and support for the following printers was added in 3.11.5

- HP Designjet T790ps 24in
- HP Designjet T790ps 44in
- HP Designjet T1300 Postscript
- HP LaserJet M4555 MFP
- HP LaserJet Professional m1214nfh MFP

It also brings the following significant new features:

- Added LEDM ADF Scan support &  LEDM Wireless support

Full changelog is available upstream:
http://hplipopensource.com/hplip-web/release_notes.html
Also note there were quite some issues fixed upstream.


-------------------------------------------------------
Steps to reproduce:

- install/update to update candidate
- when you have a HP printer, check that all functions still work
and there are no regressions
Samuel Verschelde 2011-09-12 14:32:56 CEST

Keywords: (none) => Security
CC: (none) => stormi

Comment 1 claire robinson 2011-09-12 18:15:33 CEST
Does anybody have an HP printer?

CC: (none) => eeeemail

Comment 2 Dave Hodgins 2011-09-12 23:54:37 CEST
I only have a canon.  I'll ask on usenet, and the general
discussion mailing list for volunteers to test it.

Note that wget will have to be copied to updates testing,
and later to updates.

CC: (none) => davidwhodgins

Comment 3 Jari S 2011-09-13 08:05:38 CEST
HP Photosmart Premium eAll-in-One C310a (CN503B) not working. PPD missing. Is included in Cauldron package hplip-hpijs-ppds-3.11.7-1.mga2.x86_64 but not in Mageia 1 package from testing hplip-hpijs-ppds-3.11.7-1.1.mga1.x86_64.

CC: (none) => lihamakaroonilaatikko

Comment 4 Tony Blackwell 2011-09-13 09:17:51 CEST
I picked up on Dave Hodgins request to test hplip, from the mageia-discuss digest.

I followed his request as reproduced at the bottom, but get the response to his urpmi:

Package hplip-3.11.3a-5.mga1.x86_64 is already installed

What version of hplip is the current one to be tested?  Was enabling Core Updates Testing insufficient to expose the new hplip for download?

I've a new HP OfficeJet 6500A Plus - a very slick multifunction device installed on the home network - and would be happy to help with testing the intended version of hplip.

Tony



"To install the update, run drakrpm-edit-media (or MCC/Software
Management/Configure media sources for install and update),
and enable the "Core Updates Testing" repository."

CC: (none) => t.blackwell

Comment 5 Samuel Verschelde 2011-09-13 10:38:22 CEST
(In reply to comment #4)
> "To install the update, run drakrpm-edit-media (or MCC/Software
> Management/Configure media sources for install and update),
> and enable the "Core Updates Testing" repository."

You might have to update the repositories in the "Configure media sources" screen, so that your system becomes aware of the availability of a newer package.
Comment 6 Tony Blackwell 2011-09-13 11:04:54 CEST
Did that I think - isn't that what I quoted in comment 4?  My system still has the default mirrors; not Cauldron.  Can I put the hplip to test on Mageia 1? - don't want other cauldron stuff.

What is the version number of the hplip to be tested?
Comment 7 Samuel Verschelde 2011-09-13 11:12:06 CEST
(In reply to comment #6)
> Did that I think - isn't that what I quoted in comment 4?  My system still has
> the default mirrors; not Cauldron.  Can I put the hplip to test on Mageia 1? -
> don't want other cauldron stuff.
> 
> What is the version number of the hplip to be tested?

No, you enabled Core Updates Testing, but you must also refresh the Core Updates Testing media, via "File => Update" in the "Configure media sources" screen. This way, you will make sure your system knows exactly what packages are available. Otherwise it can use an outdated package list and thus not see there is a new update. This occurs automatically for standard updates media, that's why you usually don't have to do it, but for other media it can be needed.

There's also a way to do it via command line: "urpmi.update -a".

The version of the package is that given in this bug's description: hplip-3.11.7-1.1.mga1
Comment 8 Tony Blackwell 2011-09-13 12:35:09 CEST
Thankyou for the prompt feedback and education.


Still not there yet: file -> update failed with an error message I've seen on 3 or 4 other files on 2 systems I've just installed today.  This is off-topic, but why these repeated aria2 error messages?:  


Unable to update medium; it will be automatically disabled.
Errors:
...retrieving failed: aria2 failed: exited with 3
problem reading synthesis file of medium "Core Updates Testing (distrib5)"
Comment 9 Samuel Verschelde 2011-09-13 12:54:02 CEST
(In reply to comment #8)
> Unable to update medium; it will be automatically disabled.
> Errors:
> ...retrieving failed: aria2 failed: exited with 3
> problem reading synthesis file of medium "Core Updates Testing (distrib5)"

This probably means that the mirror you are using is unavailable and that you have to use another one.

You could try to remove all your media, then select "File - add a specific media mirror" and "Full set of sources". Then select a mirror, activate the Updates Testing media, and try again. Hopefully it should work.
Comment 10 claire robinson 2011-09-13 13:00:56 CEST
Were you able to select Core Updates Testing as an update repository Tony, tick in
the box under Updates?

If not then you will need to run drakrpm-edit-media in expert mode with..

drakrpm-edit-media --expert

Remember to disable Core Updates Testing after updating hplip though or next
time MageiaUpdate runs it will update with everything from the testing
repository, which you probably don't want to do.
Comment 11 Florian Hubold 2011-09-13 13:41:47 CEST
(In reply to comment #3)
> HP Photosmart Premium eAll-in-One C310a (CN503B) not working. PPD missing. Is
> included in Cauldron package hplip-hpijs-ppds-3.11.7-1.mga2.x86_64 but not in
> Mageia 1 package from testing hplip-hpijs-ppds-3.11.7-1.1.mga1.x86_64.

Sorry, that can't be, there are no real differences between both packages, and the PPD is in the Mageia 1 updates_testing packages, you can check that for yourself:

rpm -qpl http://ftp.mandrivauser.de/mirrors/Mageia/distrib/1/x86_64/media/core/updates_testing/hplip-hpijs-ppds-3.11.7-1.1.mga1.x86_64.rpm | grep -i c310
/usr/share/ppd/HP/hp-photosmart_c3100_series.ppd.gz
/usr/share/ppd/HP/hp-photosmart_prem_c310_series.ppd.gz

The second one should be the PPD you need, or not?


Also i checked if there are other differences between those packages, and as i said, there can't be any or you installation is damaged:

[doktor5000@mageia1 ~]$ rpmdiff -iT hplip-hpijs-ppds-3.11.7-1.1.mga1.x86_64.rpm hplip-hpijs-ppds-3.11.7-1.mga2.x86_64.rpm
removed     PROVIDES hplip-hpijs-ppds(x86-64) = 3.11.7-1.1.mga1
added       PROVIDES hplip-hpijs-ppds(x86-64) = 3.11.7-1.mga2
Comment 12 Jari S 2011-09-13 14:00:42 CEST
Reinstallation did the trick so there was something odd with downloaded package. Well, scanning works, printing works with HP Photosmart Premium eAll-in-One C310a (CN503B). Looks like there is some naming convention restrictions since I have printer named "hp" configured in my laptop and I could not create "hp" named printer on the desktop. The "Add printer" button stayed grey.
Comment 13 isadora 2011-09-13 14:37:13 CEST
Installed the new driver as per description at Mageia 1 64bits-system.
Printing went just fine. Did not try any utterly advanced, but just straight
away printing of a text-document.
HP Device Manager (version 15, (Qt4)) comes up without problems, showing the
right printer with the right properties.
Type of printer: HP ColorLaserJet CP1515n

Steps executed:

[root@localhost urpmi]# urpmi hplip
To satisfy dependencies, the following packages are going to be installed:
   Package                        Version      Release       Arch
(medium "core updates testing mdvde")
  hplip                          3.11.7       1.1.mga1      x86_64
  hplip-gui                      3.11.7       1.1.mga1      x86_64
90KB of additional disk space will be used.
6.8MB of packages will be retrieved.
Proceed with the installation of the 2 packages? (Y/n) Y


   
ftp://ftp.mandrivauser.de/mirrors/Mageia/distrib/1/x86_64/media/core/updates_testing/hplip-gui-3.11.7-1.1.mga1.x86_64.rpm
   
ftp://ftp.mandrivauser.de/mirrors/Mageia/distrib/1/x86_64/media/core/updates_testing/hplip-3.11.7-1.1.mga1.x86_64.rpm

installing hplip-gui-3.11.7-1.1.mga1.x86_64.rpm hplip-3.11.7-1.1.mga1.x86_64
.rpm from /var/cache/urpmi/rpms
Preparing...                     #############################################
      1/2: hplip                 #############################################
      2/2: hplip-gui             #############################################
[root@localhost urpmi]# service cups restart
Stopping CUPS printing system:                                  [  OK  ]
Starting CUPS printing system:                                  [  OK  ]

CC: (none) => isis2000

Comment 14 Derek Jennings 2011-09-13 23:00:41 CEST
hplip-3.11.7-1.1.mga1.x86_64.rpm and hplip-gui-3.11.7-1.1.mga1.x86_64.rpm working fine here on x86_64 using an Officejet 7400.

HP-Toolbox working with all features. Printing from applications working OK

CC: (none) => derekjenn

Comment 15 Maximiliano Duarte 2011-09-14 19:34:54 CEST
(In reply to comment #0)
> There is now hplip-3.11.7-1.1.mga1 in core/updates_testing to validate
> 
> 
> Suggested advisory:
> -------------------
> This update addresses the folloving CVEs:
> 
> - CVE-2011-2722
> 
> A temporary file handling flaw was reported [1] in prnt/hpijs/hpcupsfax.cpp,
> the hplip HP CUPS filter.  Because a predicatable temporary filename is used
> (/tmp/hpcupsfax.out), an attacker could use a symlink attack to overwrite an
> arbitrary file with the privileges of the process running the HP CUPS fax
> filter.
> 
> [1] https://bugzilla.novell.com/show_bug.cgi?id=704608
> 
> Other fixes in this release:
> 
> - added Requires on wget to avoid misleading errors about network connectivity
> - added Device ID for HP LaserJet Professional P1606dn
> 
> hplip-3.11.7 adds support for the following printers:
> 
> - HP DeskJet 3050A J611 series
> - HP LaserJet 100 Color MFP M175
> - HP LaserJet Professional M1216nfh MFP
> - HP LaserJet Professional M1219nf MFP
> 
> and support for the following printers was added in 3.11.5
> 
> - HP Designjet T790ps 24in
> - HP Designjet T790ps 44in
> - HP Designjet T1300 Postscript
> - HP LaserJet M4555 MFP
> - HP LaserJet Professional m1214nfh MFP
> 
> It also brings the following significant new features:
> 
> - Added LEDM ADF Scan support &  LEDM Wireless support
> 
> Full changelog is available upstream:
> http://hplipopensource.com/hplip-web/release_notes.html
> Also note there were quite some issues fixed upstream.
> 
> 
> -------------------------------------------------------
> Steps to reproduce:
> 
> - install/update to update candidate
> - when you have a HP printer, check that all functions still work
> and there are no regressions

CC: (none) => maximiliano.duarte

Comment 16 Maximiliano Duarte 2011-09-14 19:37:20 CEST
Im testing updates_testing packages for Mageia 1, but via lan cant find any printer over lan.
when connect via usb say:

ERROR> plu-ing file does not match its digital signature
File may been corrupted or altered
error code 2

The printer you are trying to setup requiere a binary driver plugin and fail to install

Printer hp1018
mageia 1 x86_64
Comment 17 Florian Hubold 2011-09-14 19:42:24 CEST
Were you able to setup the printer with the former version of hplip in Mageia 1, version 3.11.3a?

To me it seems the download of the plugin failed, could you please try again to setup the printer?
Comment 18 Maximiliano Duarte 2011-09-14 19:51:53 CEST
dont, only test the version 3.11.7. I try again with 3.11.3a
Comment 19 Maximiliano Duarte 2011-09-14 20:08:55 CEST
no run, with v 3.11.3a same error with 3.11.7
Comment 20 Maximiliano Duarte 2011-09-14 20:13:48 CEST
no run, with v 3.11.3a same error with 3.11.7
Comment 21 Florian Hubold 2011-09-14 21:20:25 CEST
Well, then it's an upstream problem.
Either try out troubleshooting: http://hplipopensource.com/node/224

Or report directly as a bug to hplip developers:
https://launchpad.net/hplip/+filebug
Comment 22 Florian Hubold 2011-09-14 22:57:00 CEST
Maxi: Take a look at: https://bugs.launchpad.net/hplip/+bug/846924
The problem is the firmware is stored at openprinting.org, and that site is down (together with most other sites of Linux Foundation due to a security breach) and so downloading will fail as long as that site is not up again.
Not really something we can fix, so this is not blocking the update.
Comment 23 Thomas Andrews 2011-09-15 04:46:29 CEST
32-bit Mageia, Sempron 3100+ processor on an Asus Socket 754 motherboard with 2GB RAM. Two HP printers, a Deskjet 5650 and an Officejet 6110. Same duplexer works with both, currently installed on the 5650.

Tried the HP Device manager test page, a LibreOffice two-page spreadsheet, and a color photo in The Gimp with each printer, all on plain paper. Test page and photo printed fine. When printed in single page mode, the spreadsheet also worked fine with each printer. When printed in duplex, the first half-inch of both pages (part of the header) did not print. (I don't know if this happened in hplip 3.11.3a or not - never happened to print this particular file this way before.)

As with all versions of hplip that I've used since Mandriva 2010.1, when printing a job with an odd number of pages in duplex, the last page gets "stuck" in the printer and will not eject until the power button is pressed. This is looking less and less like a problem with hplip all the time. The hplip guys have tried to reproduce the problem with Mandriva 2010.2, but have failed to do so, so it looks like something unique to my system.

The scanner on the Officejet appears to work normally, when used through The Gimp.

CC: (none) => andrewsfarm

Comment 24 claire robinson 2011-09-15 19:06:24 CEST
Thankyou everybody who has tested this! I hope it wasn't too troublesome for you.

If you're not already involved, you might like to help with Mageia in the QA team?

You are most welcome to come and see us in #mageia-qa on irc.freenode.net and sign up for the mailing lists at https://ml.mageia.org/wwsympa-wrapper.fcgi/lists/qa
There is also a slowly growing QA wiki page at http://www.mageia.org/wiki/doku.php?id=qa_updates



I think with all the generous help we have had we can safely validate this now.


Advisory:

-------------------
This update addresses the folloving CVEs:

- CVE-2011-2722

A temporary file handling flaw was reported [1] in prnt/hpijs/hpcupsfax.cpp,
the hplip HP CUPS filter.  Because a predicatable temporary filename is used
(/tmp/hpcupsfax.out), an attacker could use a symlink attack to overwrite an
arbitrary file with the privileges of the process running the HP CUPS fax
filter.

[1] https://bugzilla.novell.com/show_bug.cgi?id=704608

Other fixes in this release:

- added Requires on wget to avoid misleading errors about network connectivity
- added Device ID for HP LaserJet Professional P1606dn

hplip-3.11.7 adds support for the following printers:

- HP DeskJet 3050A J611 series
- HP LaserJet 100 Color MFP M175
- HP LaserJet Professional M1216nfh MFP
- HP LaserJet Professional M1219nf MFP

and support for the following printers was added in 3.11.5

- HP Designjet T790ps 24in
- HP Designjet T790ps 44in
- HP Designjet T1300 Postscript
- HP LaserJet M4555 MFP
- HP LaserJet Professional m1214nfh MFP

It also brings the following significant new features:

- Added LEDM ADF Scan support &  LEDM Wireless support

Full changelog is available upstream:
http://hplipopensource.com/hplip-web/release_notes.html
Also note there were quite some issues fixed upstream.


-------------------------------------------------------


SRPM: hplip-3.11.7-1.1.mga1.src.rpm

Please note that wget (wget-1.12-5.mga1.src.rpm) will require linking from core/release to core/updates when this is pushed due to bug 2317.

Could somebody from sysadmin please push from core/updates_testing to core/updates.

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 25 D Morgan 2011-09-18 02:52:36 CEST
update pushed.  
wget linked.

Status: NEW => RESOLVED
CC: (none) => dmorganec
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.