RHSA-2009:1595: Moderate: cups security update
The Common UNIX Printing System (CUPS) provides a portable printing layerfor UNIX operating systems.A use-after-free flaw was found in the way CUPS handled references in itsfile descriptors-handling interface. A remote attacker could, in aspecially-crafted way, query for the list of current print jobs for aspecific printer, leading to a denial of service (cupsd crash).(CVE-2009-3553)Several cross-site scripting (XSS) flaws were found in the way the CUPS webserver interface processed HTML form content. If a remote attacker couldtrick a local user who is logged into the CUPS web interface into visitinga specially-crafted HTML page, the attacker could retrieve and potentiallymodify confidential CUPS administration data. (CVE-2009-2820)Red Hat would like to thank Aaron Sigel of Apple Product Security forresponsibly reporting the CVE-2009-2820 issue.Users of cups are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. After installing theupdate, the cupsd daemon will be restarted automatically.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:1595?
The severity of RHSA-2009:1595 is classified as moderate.
How do I fix RHSA-2009:1595?
To fix RHSA-2009:1595, update the CUPS packages to version 1.3.7-11.el5_4.4 or later.
What systems are affected by RHSA-2009:1595?
RHSA-2009:1595 affects systems running CUPS versions prior to 1.3.7-11.el5_4.4.
Can RHSA-2009:1595 be exploited by a remote attacker?
Yes, RHSA-2009:1595 can be exploited by a remote attacker through a specially-crafted request.
Which components of CUPS are impacted by RHSA-2009:1595?
RHSA-2009:1595 impacts various components including cups, cups-devel, cups-libs, and cups-lpd.