Summary: | <net-print/cups-1.7.4: Incomplete fix for CVE-2014-3537 (CVE-2014-{5029,5030,5031}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | ||
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1122600 | ||
Whiteboard: | B4 [noglsa] | ||
Package list: | Runtime testing required: | --- |
Description
Agostino Sarubbo
2014-07-24 07:58:10 UTC
CVE-2014-5029 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5029): The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537. CVE-2014-5031 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5031): The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors. CVE-2014-5030 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5030): CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py. Sorry for the noise this actually has 3 CVE's assigned to it. This is fixed in CUPS 1.7.4 Security: The web interface incorrectly served symlinked files and files that were not world-readable, potentially leading to a disclosure of information (STR #4450) Maintainer(s): after the bump please let us know when the ebuild is ready for stabilization. (In reply to Yury German from comment #3) > Sorry for the noise this actually has 3 CVE's assigned to it. > > This is fixed in CUPS 1.7.4 > Security: The web interface incorrectly served symlinked files and files > that were not world-readable, potentially leading to a disclosure of > information (STR #4450) > > Maintainer(s): after the bump please let us know when the ebuild is ready > for stabilization. Let's go for cups-1.7.5 (another bug squashed there) instead, see bug 519792 The lowest awailable version (and also currently stable version) in the tree is now 1.7.5. All affected ebuilds are long gone from the tree. Printing out. GLSA vote: no. GLSA Vote: No |