CVE-2008-5286 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5286): Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.
Please apply the patch or bump to 1.3.10 ASAP.
Upstream patch added in net-print/cups-1.3.9-r1.
Arches, please test and mark stable: =net-print/cups-1.3.9-r1 Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"
ppc stable
amd64 stable
rerating B1, network connectivity is not default and cups does not run as root, but lp.
x86 stable
ppc64 done
Stable for HPPA.
sparc stable
arm/ia64 stable
Stable on alpha.
GLSA 200812-11 (apologies to Gentoo alpha users which got an unstable 1.3.9-r1 for a few hours after the advisory was sent)