rhsa-2002_295
Vulnerability from csaf_redhat
Published
2003-01-13 15:34
Modified
2024-11-21 22:34
Summary
Red Hat Security Advisory: : Updated CUPS packages fix various vulnerabilities

Notes

Topic
Updated CUPS packages are available for Red Hat Linux 7.3 and 8.0 which fix various security issues.
Details
The Common UNIX Printing System (CUPS) provides a portable printing layer. A number of vulnerabilities have been discovered in CUPS. CUPS was distributed with Red Hat Linux 7.3 and 8.0 but is not installed by default. 1. An integer overflow exists in the CUPS HTTP interface that allows a local attacker to gain the permissions of the 'lp' user. (CAN-2002-1383) 2. A race condition exists in the creation of a pid file which allows an attacker who already has privileges of the 'lp' user (for example from utilizing a different exploit) to create or overwrite any file as root, leading to arbitrary code execution. (CAN-2002-1366) 3. It is possible to remotely add a printer to CUPS by sending a specially crafted UDP packet. If an attacker utilizes this vulnerability, they could add a printer with a tainted name that if clicked on in the web administration interface could be used to exploit other vulnerabilities. (CAN-2002-1367) By utilizing this vulnerability, an attacker could take a number of steps to be able to get hold of the certificate used to access the administrative section of the CUPS server and potentially add a printer that will execute commands with root privileges. 4. Problems with chunked encoding and negative content length handling in the CUPS HTTP interface can cause CUPS to crash. On Red Hat Linux platforms this can cause a denial of service (DoS) against CUPS. (CAN-2002-1368) 5. A number of integer overflows exist in the image handling code of the filters in CUPS. In addition, CUPS does not properly check for zero width GIF images. These vulnerabilities allow an attacker who has the ability to print to run arbitrary code as the 'lp' user. (CAN-2002-1371) 6. An integer overflow exists in the CUPS pdftops filter. This can be exploited by an attacker who is able to print sending a carefully crafted PDF file which can execute arbitrary commands as the 'lp' user. (CAN-2002-1384) 7. A buffer overflow exists in setting up the job management options. When combined with other vulnerabilities, this could allow a local user to gain root privileges. This issue only affects the version of CUPS shipped with Red Hat Linux 7.3. (CAN-2002-1369) 8. A bug in the select() call would allow an easy DoS attack which would cause CUPS to not recover once the DoS has stopped. (CAN-2002-1372) Red Hat Linux 7.3 and 8.0 were shipped with versions of CUPS that are vulnerable to these issues. All users of CUPS are advised to upgrade to the erratum packages which contain a patch to correct these issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated CUPS packages are available for Red Hat Linux 7.3 and 8.0 which fix\nvarious security issues.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Common UNIX Printing System (CUPS) provides a portable printing\nlayer.  A number of vulnerabilities have been discovered in CUPS.\n\nCUPS was distributed with Red Hat Linux 7.3 and 8.0 but is not\ninstalled by default.\n\n1. An integer overflow exists in the CUPS HTTP interface that allows\na local attacker to gain the permissions of the \u0027lp\u0027 user.  (CAN-2002-1383)\n\n2. A race condition exists in the creation of a pid file which allows\nan attacker who already has privileges of the \u0027lp\u0027 user (for example from\nutilizing a different exploit) to create or overwrite any file as\nroot, leading to arbitrary code execution.  (CAN-2002-1366)\n\n3. It is possible to remotely add a printer to CUPS by sending a\nspecially crafted UDP packet.  If an attacker utilizes this vulnerability,\nthey could add a printer with a tainted name that if clicked on in the\nweb administration interface could be used to exploit other\nvulnerabilities.  (CAN-2002-1367)\n\nBy utilizing this vulnerability, an attacker could take a number of steps\nto be able to get hold of the certificate used to access the administrative\nsection of the CUPS server and potentially add a printer that will execute\ncommands with root privileges.\n\n4. Problems with chunked encoding and negative content length handling\nin the CUPS HTTP interface can cause CUPS to crash.  On Red Hat Linux\nplatforms this can cause a denial of service (DoS) against CUPS. \n(CAN-2002-1368)\n\n5. A number of integer overflows exist in the image handling code of\nthe filters in CUPS.  In addition, CUPS does not properly check for\nzero width GIF images. These vulnerabilities allow an attacker who has\nthe ability to print to run arbitrary code as the \u0027lp\u0027 user.  (CAN-2002-1371)\n\n6. An integer overflow exists in the CUPS pdftops filter.  This can be\nexploited by an attacker who is able to print sending a carefully\ncrafted PDF file which can execute arbitrary commands as the \u0027lp\u0027 user.\n(CAN-2002-1384)\n\n7. A buffer overflow exists in setting up the job management options.\nWhen combined with other vulnerabilities, this could allow a local user\nto gain root privileges.  This issue only affects the version of CUPS\nshipped with Red Hat Linux 7.3.  (CAN-2002-1369)\n\n8. A bug in the select() call would allow an easy DoS attack which would\ncause CUPS to not recover once the DoS has stopped. (CAN-2002-1372)\n\nRed Hat Linux 7.3 and 8.0 were shipped with versions of CUPS that are\nvulnerable to these issues. All users of CUPS are advised to upgrade to the\nerratum packages which contain a patch to correct these issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:295",
        "url": "https://access.redhat.com/errata/RHSA-2002:295"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2002_295.json"
      }
    ],
    "title": "Red Hat Security Advisory: : Updated CUPS packages fix various vulnerabilities",
    "tracking": {
      "current_release_date": "2024-11-21T22:34:21+00:00",
      "generator": {
        "date": "2024-11-21T22:34:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:295",
      "initial_release_date": "2003-01-13T15:34:00+00:00",
      "revision_history": [
        {
          "date": "2003-01-13T15:34:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2003-02-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:34:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.3",
                "product": {
                  "name": "Red Hat Linux 7.3",
                  "product_id": "Red Hat Linux 7.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Linux 8.0",
                "product": {
                  "name": "Red Hat Linux 8.0",
                  "product_id": "Red Hat Linux 8.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:8.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1366",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616888"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1366"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616888",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616888"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1366",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1366"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1366",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1366"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1367",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616889"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a \"need authorization\" page, as demonstrated by new-coke.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1367"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616889",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616889"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1367"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1368",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616890"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1368"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616890",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616890"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1368",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1368"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1368",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1368"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1369",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616891"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string, which allows remote attackers to execute arbitrary code via a buffer overflow attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1369"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616891",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616891"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1369"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1371",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616892"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1371"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616892",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616892"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1371",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1371"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1371",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1371"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1372",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616893"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1372"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616893",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616893"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1372",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1372"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1372",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1372"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1383",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616902"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via (1) the CUPSd HTTP interface, as demonstrated by vanilla-coke, and (2) the image handling code in CUPS filters, as demonstrated by mksun.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1383"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616902",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616902"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1383",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1383"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1383",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1383"
        }
      ],
      "release_date": "2002-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1384",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616903"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3",
          "Red Hat Linux 8.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1384"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616903",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616903"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1384",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1384"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1384",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1384"
        }
      ],
      "release_date": "2002-12-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-01-13T15:34:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3",
            "Red Hat Linux 8.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:295"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.