Synopsis

Moderate: cups security update

Type/Severity

Security Advisory: Moderate

Topic

Updated cups packages that fix a security issue are now available for Red
Hat Enterprise Linux 3, Red Hat Enterprise Linux 4, and Red Hat Enterprise
Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The Common UNIX Printing System (CUPS) provides a portable printing layer
for UNIX operating systems.

An integer overflow flaw leading to a heap buffer overflow was discovered
in the Portable Network Graphics (PNG) decoding routines used by the CUPS
image converting filters "imagetops" and "imagetoraster". An attacker could
create a malicious PNG file that could possibly execute arbitrary code as
the "lp" user if the file was printed. (CVE-2008-1722)

All CUPS users are advised to upgrade to these updated packages, which
contain backported patch to resolve this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.6 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 441692 - CVE-2008-1722 cups: integer overflow in the image filter

CVEs

• CVE-2008-1722

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
cups-libs-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: d0eb6f133f39792b242a7b9677cff98dcdd296c62fda1413fbab73786d91f555
s390
cups-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: 840bf3d0491b907505c78310f87d06ab67a0342613f1f493d21dadba668c5fb4
cups-devel-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: d52393cfcde978208b4ce88e39c05b4dab15efc1e3963e61f98caeae3b782fba
cups-libs-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: d0eb6f133f39792b242a7b9677cff98dcdd296c62fda1413fbab73786d91f555

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6

SRPM
s390x
cups-libs-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: d0eb6f133f39792b242a7b9677cff98dcdd296c62fda1413fbab73786d91f555
s390
cups-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: 840bf3d0491b907505c78310f87d06ab67a0342613f1f493d21dadba668c5fb4
cups-devel-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: d52393cfcde978208b4ce88e39c05b4dab15efc1e3963e61f98caeae3b782fba
cups-libs-1.1.22-0.rc1.9.20.2.el4_6.8.s390.rpm	SHA-256: d0eb6f133f39792b242a7b9677cff98dcdd296c62fda1413fbab73786d91f555