CVE-2010-5325: Buffer Overflow

It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code.

This flaw was fixed upstream back in 2010, without much attention being given to the possible security implications of it. It is a remote buffer overflow with possibility of executing arbitrary code, with only a few restrictions, such as having the cups service open to the network and a particular kind of filter in use.

Analysis by Engineering shows that only RHEL-6 contains the affected code, so RHEL-5, RHEL-7 and Fedora are not affected. Giving this flaw a Moderate rating, despite the 7.7 CVSSv2 score, as cups is not usually configured widely open to the network or internet at large, and because it depends on a particular kind of filter being used.

References: https://bugs.linuxfoundation.org/showbug.cgi?id=515

— Red Hat