Synopsis

Important: cups security update

Type/Severity

Security Advisory: Important

Topic

Updated CUPS packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The Common UNIX Printing System (CUPS) provides a portable printing layer
for UNIX(R) operating systems.

Alin Rad Pop discovered several flaws in the handling of PDF files. An
attacker could create a malicious PDF file that would cause CUPS to crash
or potentially execute arbitrary code when printed.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

All CUPS users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.1 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.1 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.1 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.1 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit()
• BZ - 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset()
• BZ - 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar()

CVEs

• CVE-2007-5393
• CVE-2007-5392
• CVE-2007-4352

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
cups-1.2.4-11.14.el5_1.3.src.rpm	SHA-256: 27ad34229380d2bca84eb324ad12b300bd11345c111575117651abb166e4bfcf
x86_64
cups-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 4d909440aeec0c8a6cc3cc4ac2773c6f36e0a520f5c6ba6734fbcd14d811e7c7
cups-devel-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: 4ece87bc6f4becd74810ddfa78f2937f723b903417c7a1af22c302c66cb17e88
cups-devel-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 6094e0f364bc31a972ae48ddf9714142c8a2924aa10c0e79b90dfef19e32deb8
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-libs-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: b5f5c6c31b550a7a9bae7ecb70a7bb13ef13baedda8e6248eb2c2fa601f4de42
cups-lpd-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: df84b721452f9d61caff0e3f6397252f2d3794f911b4db9998c3abe8b6f2a2fd
ia64
cups-1.2.4-11.14.el5_1.3.ia64.rpm	SHA-256: 70fe59666bc0592af8bf2fd0f9a77b00e4b1c43a6f79dec8a53af010886697ec
cups-devel-1.2.4-11.14.el5_1.3.ia64.rpm	SHA-256: ba9efa0a16b3ab83275a2fa0896a4bf9b8f75cbf2684b0a9ec7d3175bdd4314f
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-libs-1.2.4-11.14.el5_1.3.ia64.rpm	SHA-256: c4ea4d88b35add7b43de593c1d4fb7c921f43218675ae70c0316869c29fdaa33
cups-lpd-1.2.4-11.14.el5_1.3.ia64.rpm	SHA-256: 405258745ac0dbf16347a99d46172d1422e21d490e932cca959faabced1d9e77
i386
cups-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b4c1421b4fa85c568d8bee4e61d7024b9e1341d07c436875bc7228b3a76df3a3
cups-devel-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: 4ece87bc6f4becd74810ddfa78f2937f723b903417c7a1af22c302c66cb17e88
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-lpd-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b2a494081ecfa96566635ae070d185169a3729b67a4bf9bef413489e5fdae8ab

Red Hat Enterprise Linux Workstation 5

SRPM
cups-1.2.4-11.14.el5_1.3.src.rpm	SHA-256: 27ad34229380d2bca84eb324ad12b300bd11345c111575117651abb166e4bfcf
x86_64
cups-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 4d909440aeec0c8a6cc3cc4ac2773c6f36e0a520f5c6ba6734fbcd14d811e7c7
cups-devel-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: 4ece87bc6f4becd74810ddfa78f2937f723b903417c7a1af22c302c66cb17e88
cups-devel-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 6094e0f364bc31a972ae48ddf9714142c8a2924aa10c0e79b90dfef19e32deb8
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-libs-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: b5f5c6c31b550a7a9bae7ecb70a7bb13ef13baedda8e6248eb2c2fa601f4de42
cups-lpd-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: df84b721452f9d61caff0e3f6397252f2d3794f911b4db9998c3abe8b6f2a2fd
i386
cups-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b4c1421b4fa85c568d8bee4e61d7024b9e1341d07c436875bc7228b3a76df3a3
cups-devel-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: 4ece87bc6f4becd74810ddfa78f2937f723b903417c7a1af22c302c66cb17e88
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-lpd-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b2a494081ecfa96566635ae070d185169a3729b67a4bf9bef413489e5fdae8ab

Red Hat Enterprise Linux Desktop 5

SRPM
cups-1.2.4-11.14.el5_1.3.src.rpm	SHA-256: 27ad34229380d2bca84eb324ad12b300bd11345c111575117651abb166e4bfcf
x86_64
cups-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 4d909440aeec0c8a6cc3cc4ac2773c6f36e0a520f5c6ba6734fbcd14d811e7c7
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-libs-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: b5f5c6c31b550a7a9bae7ecb70a7bb13ef13baedda8e6248eb2c2fa601f4de42
cups-lpd-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: df84b721452f9d61caff0e3f6397252f2d3794f911b4db9998c3abe8b6f2a2fd
i386
cups-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b4c1421b4fa85c568d8bee4e61d7024b9e1341d07c436875bc7228b3a76df3a3
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-lpd-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b2a494081ecfa96566635ae070d185169a3729b67a4bf9bef413489e5fdae8ab

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
cups-1.2.4-11.14.el5_1.3.src.rpm	SHA-256: 27ad34229380d2bca84eb324ad12b300bd11345c111575117651abb166e4bfcf
s390x
cups-1.2.4-11.14.el5_1.3.s390x.rpm	SHA-256: b3c54aefe4eda79b6cb77162512f08bf54052ec8c5b51ad47b0210d5b25c7287
cups-devel-1.2.4-11.14.el5_1.3.s390.rpm	SHA-256: d3de759538c22a89297ed6ccf4c2f0523c02d738480e577e3cb035dcf4aa1c35
cups-devel-1.2.4-11.14.el5_1.3.s390x.rpm	SHA-256: 19789ab5b7f22012b3ad5479cef1830c83d21a3ffbda3f037114b6bdf3b48f8e
cups-libs-1.2.4-11.14.el5_1.3.s390.rpm	SHA-256: ddfb2852d551385676018d2b0ac8a9ab0560a7c536317491aced08001bbe7bca
cups-libs-1.2.4-11.14.el5_1.3.s390x.rpm	SHA-256: a180b852f5ea8e8310565b989ca68894b13e76563cd5a5bc7c31b6489b1c7859
cups-lpd-1.2.4-11.14.el5_1.3.s390x.rpm	SHA-256: 23cee53d08404cf4223757c15bb6da03370d69770342e6091e364d7e79490d82

Red Hat Enterprise Linux for Power, big endian 5

SRPM
cups-1.2.4-11.14.el5_1.3.src.rpm	SHA-256: 27ad34229380d2bca84eb324ad12b300bd11345c111575117651abb166e4bfcf
ppc
cups-1.2.4-11.14.el5_1.3.ppc.rpm	SHA-256: 65213e59ca41efb7e7cef8c9a000ecb24b6c6912f9479f54ed309b04d4122ace
cups-devel-1.2.4-11.14.el5_1.3.ppc.rpm	SHA-256: b5ef72bbe7d146de86f8f2ec6a3e6532c9b42a46a3e91cbc0568fb95884a8f92
cups-devel-1.2.4-11.14.el5_1.3.ppc64.rpm	SHA-256: b1bae33f500a5a334bdfc19c0491109fbf008df3fdc19666ac38c68f7d200431
cups-libs-1.2.4-11.14.el5_1.3.ppc.rpm	SHA-256: ad4abf6c9a49670001f58bc8cb9b574aa0b23a327f0379b83691a628e3d300e0
cups-libs-1.2.4-11.14.el5_1.3.ppc64.rpm	SHA-256: a5b968c7fd0333c1594004b4ce956cda71f58934c57b33dd5c3c448d60b0949b
cups-lpd-1.2.4-11.14.el5_1.3.ppc.rpm	SHA-256: ba657aae72d9fa3acef717acb16412fed9eefac8af85c81cdeae330dc4dbf8b0

Red Hat Enterprise Linux Server from RHUI 5

SRPM
cups-1.2.4-11.14.el5_1.3.src.rpm	SHA-256: 27ad34229380d2bca84eb324ad12b300bd11345c111575117651abb166e4bfcf
x86_64
cups-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 4d909440aeec0c8a6cc3cc4ac2773c6f36e0a520f5c6ba6734fbcd14d811e7c7
cups-devel-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: 4ece87bc6f4becd74810ddfa78f2937f723b903417c7a1af22c302c66cb17e88
cups-devel-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: 6094e0f364bc31a972ae48ddf9714142c8a2924aa10c0e79b90dfef19e32deb8
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-libs-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: b5f5c6c31b550a7a9bae7ecb70a7bb13ef13baedda8e6248eb2c2fa601f4de42
cups-lpd-1.2.4-11.14.el5_1.3.x86_64.rpm	SHA-256: df84b721452f9d61caff0e3f6397252f2d3794f911b4db9998c3abe8b6f2a2fd
i386
cups-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b4c1421b4fa85c568d8bee4e61d7024b9e1341d07c436875bc7228b3a76df3a3
cups-devel-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: 4ece87bc6f4becd74810ddfa78f2937f723b903417c7a1af22c302c66cb17e88
cups-libs-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: f48e5a30d62588913629a3a3bda5fa6625678ea864e00ae6dc13566abb953fec
cups-lpd-1.2.4-11.14.el5_1.3.i386.rpm	SHA-256: b2a494081ecfa96566635ae070d185169a3729b67a4bf9bef413489e5fdae8ab