RHSA-2009:0429: Important: cups security update

The Common UNIX® Printing System (CUPS) provides a portable printing layerfor UNIX operating systems.Multiple integer overflow flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashor, potentially, execute arbitrary code as the "lp" user if the file wasprinted. (CVE-2009-0147, CVE-2009-1179)Multiple buffer overflow flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashor, potentially, execute arbitrary code as the "lp" user if the file wasprinted. (CVE-2009-0146, CVE-2009-1182)Multiple flaws were found in the CUPS JBIG2 decoder that could lead to thefreeing of arbitrary memory. An attacker could create a malicious PDF filethat would cause CUPS to crash or, potentially, execute arbitrary codeas the "lp" user if the file was printed. (CVE-2009-0166, CVE-2009-1180)Multiple input validation flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashor, potentially, execute arbitrary code as the "lp" user if the file wasprinted. (CVE-2009-0800)An integer overflow flaw, leading to a heap-based buffer overflow, wasdiscovered in the Tagged Image File Format (TIFF) decoding routines used bythe CUPS image-converting filters, "imagetops" and "imagetoraster". Anattacker could create a malicious TIFF file that could, potentially,execute arbitrary code as the "lp" user if the file was printed.(CVE-2009-0163)Multiple denial of service flaws were found in the CUPS JBIG2 decoder. Anattacker could create a malicious PDF file that would cause CUPS to crashwhen printed. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)Red Hat would like to thank Aaron Sigel, Braden Thomas and Drew Yao ofthe Apple Product Security team, and Will Dormann of the CERT/CC forresponsibly reporting these flaws.Users of cups are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. After installing theupdate, the cupsd daemon will be restarted automatically.