Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.70314
Category:Mandrake Local Security Checks
Title:Mandriva Security Advisory MDVSA-2011:146 (cups)
Summary:NOSUMMARY
Description:Description:
The remote host is missing an update to cups
announced via advisory MDVSA-2011:146.

Multiple vulnerabilities has been discovered and corrected in cups:

The cupsDoAuthentication function in auth.c in the client in CUPS
before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a
demand for authorization, which allows remote CUPS servers to cause
a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses
(CVE-2010-2432).

The LZW decompressor in the LWZReadByte function in giftoppm.c in
the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw
function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte
function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier,
the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4
and earlier, and other products, does not properly handle code words
that are absent from the decompression table when encountered, which
allows remote attackers to trigger an infinite loop or a heap-based
buffer overflow, and possibly execute arbitrary code, via a crafted
compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895
(CVE-2011-2896).

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896 (CVE-2011-3170).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.

Affected: 2009.0, 2010.1, Enterprise Server 5.0

Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2011:146

Risk factor : High

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-2432
Debian Security Information: DSA-2176 (Google Search)
http://www.debian.org/security/2011/dsa-2176
http://security.gentoo.org/glsa/glsa-201207-10.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2011:146
http://secunia.com/advisories/43521
http://www.vupen.com/english/advisories/2011/0535
Common Vulnerability Exposure (CVE) ID: CVE-2006-1168
BugTraq ID: 19455
http://www.securityfocus.com/bid/19455
Debian Security Information: DSA-1149 (Google Search)
http://www.debian.org/security/2006/dsa-1149
http://security.gentoo.org/glsa/glsa-200610-03.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2006:140
http://www.mandriva.com/security/advisories?name=MDVSA-2012:129
http://bugs.gentoo.org/show_bug.cgi?id=141728
https://bugzilla.redhat.com/show_bug.cgi?id=728536
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9373
http://www.redhat.com/support/errata/RHSA-2006-0663.html
RedHat Security Advisories: RHSA-2012:0810
http://rhn.redhat.com/errata/RHSA-2012-0810.html
http://securitytracker.com/id?1016836
http://secunia.com/advisories/21427
http://secunia.com/advisories/21434
http://secunia.com/advisories/21437
http://secunia.com/advisories/21467
http://secunia.com/advisories/21880
http://secunia.com/advisories/22036
http://secunia.com/advisories/22296
http://secunia.com/advisories/22377
SGI Security Advisory: 20060901-01-P
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
SuSE Security Announcement: SUSE-SR:2006:020 (Google Search)
http://www.novell.com/linux/security/advisories/2006_20_sr.html
http://www.vupen.com/english/advisories/2006/3234
XForce ISS Database: ncompress-decompress-underflow(28315)
https://exchange.xforce.ibmcloud.com/vulnerabilities/28315
Common Vulnerability Exposure (CVE) ID: CVE-2011-2895
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
BugTraq ID: 49124
http://www.securityfocus.com/bid/49124
Debian Security Information: DSA-2293 (Google Search)
http://www.debian.org/security/2011/dsa-2293
http://www.mandriva.com/security/advisories?name=MDVSA-2011:153
http://www.openwall.com/lists/oss-security/2011/08/10/10
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html
NETBSD Security Advisory: NetBSD-SA2011-007
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc
http://www.redhat.com/support/errata/RHSA-2011-1154.html
http://www.redhat.com/support/errata/RHSA-2011-1155.html
http://www.redhat.com/support/errata/RHSA-2011-1161.html
http://www.redhat.com/support/errata/RHSA-2011-1834.html
http://securitytracker.com/id?1025920
http://secunia.com/advisories/45544
http://secunia.com/advisories/45568
http://secunia.com/advisories/45599
http://secunia.com/advisories/45986
http://secunia.com/advisories/46127
http://secunia.com/advisories/48951
SuSE Security Announcement: SUSE-SU-2011:1035 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00019.html
SuSE Security Announcement: openSUSE-SU-2011:1299 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00004.html
http://www.ubuntu.com/usn/USN-1191-1
XForce ISS Database: xorg-lzw-bo(69141)
https://exchange.xforce.ibmcloud.com/vulnerabilities/69141
Common Vulnerability Exposure (CVE) ID: CVE-2011-2896
BugTraq ID: 49148
http://www.securityfocus.com/bid/49148
Debian Security Information: DSA-2354 (Google Search)
http://www.debian.org/security/2011/dsa-2354
Debian Security Information: DSA-2426 (Google Search)
http://www.debian.org/security/2012/dsa-2426
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064873.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064600.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065550.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065651.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065527.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065539.html
http://security.gentoo.org/glsa/glsa-201209-23.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2011:167
http://www.redhat.com/support/errata/RHSA-2011-1635.html
RedHat Security Advisories: RHSA-2012:1180
http://rhn.redhat.com/errata/RHSA-2012-1180.html
RedHat Security Advisories: RHSA-2012:1181
http://rhn.redhat.com/errata/RHSA-2012-1181.html
http://www.securitytracker.com/id?1025929
http://secunia.com/advisories/45621
http://secunia.com/advisories/45900
http://secunia.com/advisories/45945
http://secunia.com/advisories/45948
http://secunia.com/advisories/46024
http://secunia.com/advisories/48236
http://secunia.com/advisories/48308
http://secunia.com/advisories/50737
http://www.ubuntu.com/usn/USN-1207-1
http://www.ubuntu.com/usn/USN-1214-1
Common Vulnerability Exposure (CVE) ID: CVE-2011-3170
BugTraq ID: 49323
http://www.securityfocus.com/bid/49323
http://www.mandriva.com/security/advisories?name=MDVSA-2011:147
http://www.securitytracker.com/id?1025980
http://secunia.com/advisories/45796
XForce ISS Database: cups-gifreadlzw-function-bo(69380)
https://exchange.xforce.ibmcloud.com/vulnerabilities/69380
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.