Описание
ELSA-2010-0811: cups security update (IMPORTANT)
[1.3.7-18:.8]
- Applied patch to fix cupsd memory corruption vulnerability (CVE-2010-2941, STR #3648, bug #624438).
- Fix latent privilege escalation vulnerability (CVE-2010-2431, STR #3510, bug #605397).
Обновленные пакеты
Oracle Linux 5
Oracle Linux ia64
cups
1.3.7-18.el5_5.8
cups-devel
1.3.7-18.el5_5.8
cups-libs
1.3.7-18.el5_5.8
cups-lpd
1.3.7-18.el5_5.8
Oracle Linux x86_64
cups
1.3.7-18.el5_5.8
cups-devel
1.3.7-18.el5_5.8
cups-libs
1.3.7-18.el5_5.8
cups-lpd
1.3.7-18.el5_5.8
Oracle Linux i386
cups
1.3.7-18.el5_5.8
cups-devel
1.3.7-18.el5_5.8
cups-libs
1.3.7-18.el5_5.8
cups-lpd
1.3.7-18.el5_5.8
Связанные CVE
Связанные уязвимости
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.
The cupsFileOpen function in CUPS before 1.4.4 allows local users, wit ...
ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.