oss-security - (sort of urgent) CVE Request -- cups (repost)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / articles presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures / books
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 01 Dec 2008 13:25:19 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject:  (sort of urgent) CVE Request -- cups (repost)

Hello Steve,

  could you please allocate a new CVE id for the following vulnerability
(we need to have the patch backported till December the 3-rd due some
 internal policies).

cups  -- buffer overflow in the PNG image read
      -- incomplete fix for CVE-2008-1722
(http://www.cups.org/strfiles/2790/str2790.patch)
      -- advisory: http://www.cups.org/str.php?L2974
      -- patch: http://www.cups.org/strfiles/2974/str2974.patch
      -- affects: cups-1.1.17 <= x <= cups-1.3.9
      -- references: http://www.cups.org/str.php?L2974
                     http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt (Part "- SECURITY:")

Many thanks!
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.