The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.

Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.

Multiple buffer overflow flaws were found in xpdf's JBIG2 MMR decoder. A carefully crafted PDF file could result in arbitrary code execute with the permissions of the user running xpdf.

Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.

Acknowledgements:

Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting these flaws.

Anibal Sacco from Core Security Technologies discovered a NULL pointer dereference flaw in CUPS daemon when handling the IPPTAGUNSUPPORTED, which allows remote attackers with access to CUPS' IPP port to crash cupsd.

Acknowledgements:

Red Hat would like to thank Anibal Sacco from Core Security Technologies for reporting this issue.

Heap-based buffer overflow in the readrle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded (RLE) data containing a small image and a large row count.

Integer overflow in the cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.

An integer overflow flaw was found in xpdf's JBIG2 decoder. This flaw could result in arbitrary code execute with the permissions of the user running xpdf.

Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.

Acknowledgements:

Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.

An invalid free() flaw was found in xpdf's JBIG2 decoder. If a malicious PDF file could free() attacker controlled data, it may be possible to execute arbitrary code with the permissions of the user running xpdf.

Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.

Acknowledgements:

Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.

A NULL pointer dereference issue exists in the WriteProlog function of the texttops image filter. The return value from calloc is not checked. This may lead to a NULL pointer dereference. Since the offset from the pointer at which data is subsequently written is controlled by the user, this issue may lead to application termination or arbitrary code execution.

An integer overflow issue exists within the WriteProlog() function in the texttops CUPS image filter. When calculating the page size for storing PostScript data, values are derived from user content and are used in multiplication. If the operation overflows, a small destination buffer may be allocated, resulting in a heap-based buffer overflow.

Acknowledgements:

Red Hat would like to thank "regenrecht" for reporting this issue.

The gifreadlzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

Swen van Brussel reported pointer use-after-delete flaw, present in the CUPS directory services routine, processing new data about available printers and printer classes. A remote attacker could suspend, and after a carefully-chosen time interval renew sending of CUPS browse packets to the victim machine with running cupsd daemon, leading to a denial of service (cupsd daemon stop or crash).

Acknowledgements:

Red Hat would like to thank Swen van Brussel for reporting this issue.

The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVEGSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTPUNAUTHORIZED responses.

Multiple NULL derefernce flaws were found in xpdf's JBIG2 decoder. A carefully crafted PDF file could cause xpdf to crash when opened.

Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.

Acknowledgements:

Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting these flaws.

An infinite loop flaw was found in xpdf's JBIG2 MMR decoder. If a carefully crafted PDF file is opened, it could cause xpdf to stop responding.

Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.

Acknowledgements:

Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.

The cgiinitializestring function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.

Quoting from the upstream bug report http://cups.org/str.php?L3510:

directory that is writable by unprivileged processes.

This is a latent privilege escalation vulnerability. It can be exploited only in the presence of other CUPS vulnerabilities.

Why this is privilege escalation --------------------------------

This is privilege escalation, because an unprivileged process can trick the CUPS server into overwriting arbitrary files as root.

Example:

drwxrwxr-x 4 root lp /var/cache/cups -rw-r----- 1 root lp /var/cache/cups/remote.cache

This file is opened with cupsFileOpen() which simply opens the file with open(filename, OWRONLY | OTRUNC | OCREAT | OLARGEFILE | OBINARY, 0666).

If a CUPS "external" program has a vulnerability, an attacker can use the group=lp privileges to replace /var/cache/cups/remote.cache with a symlink to a root-writable file. CUPS will then overwrite that file as root. A similar latent vulnerability exists for the state file /var/cache/cups/job.cache.

Why this is a latent vulnerability ----------------------------------

This is a latent vulnerability, because there is no known exploit for CUPS "external" programs that run as user=lp, group=lp.

The upstream fix looks more like a preventative fix as there does not seem to be anything exploitable here, so this looks like more a hardening than a response to an actual flaw.