[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 15 Aug 2011 14:02:21 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- foomatic (foomatic-filters):
foomatic-rip (debug mode) insecure temporary file use in renderer command
line by processing PostScript data
This was a strange one. Since it's pretty clear there are two
implementations (due to 2 different languages, and 2 upstream
maintainers), we treated these as separate codebases and went with two
separate CVEs. (You could argue this was the same core design problem,
but this issue wasn't due to a protocol that required such behavior.)
See below.
- Steve
======================================================
Name: CVE-2011-2697
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2697
Reference: MLIST:[oss-security] 20110713 CVE Request: hplip/foomatic-filters
Reference: URL:http://www.openwall.com/lists/oss-security/2011/07/13/3
Reference: MLIST:[oss-security] 20110718 Re: CVE Request: hplip/foomatic-filters
Reference: URL:http://www.openwall.com/lists/oss-security/2011/07/18/3
Reference: MLIST:[oss-security] 20110728 Re: CVE Request: hplip/foomatic-filters
Reference: URL:http://www.openwall.com/lists/oss-security/2011/07/28/1
Reference: CONFIRM:https://bugzilla.novell.com/show_bug.cgi?id=698451
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=721001
Reference: XF:hplinuxprinting-foomaticriphplip-code-exec(68993)
Reference: URL:http://xforce.iss.net/xforce/xfdb/68993
foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5
allows remote attackers to execute arbitrary code via a crafted
*FoomaticRIPCommandLine field in a .ppd file.
======================================================
Name: CVE-2011-2964
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2964
Reference: MLIST:[oss-security] 20110713 CVE Request: hplip/foomatic-filters
Reference: URL:http://www.openwall.com/lists/oss-security/2011/07/13/3
Reference: MLIST:[oss-security] 20110718 Re: CVE Request: hplip/foomatic-filters
Reference: URL:http://www.openwall.com/lists/oss-security/2011/07/18/3
Reference: MLIST:[oss-security] 20110728 Re: CVE Request: hplip/foomatic-filters
Reference: URL:http://www.openwall.com/lists/oss-security/2011/07/28/1
Reference: CONFIRM:https://bugzilla.novell.com/show_bug.cgi?id=698451
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=721001
Reference: REDHAT:RHSA-2011:1110
Reference: URL:http://www.redhat.com/support/errata/RHSA-2011-1110.html
Reference: XF:foomatic-foomatic-code-execution(68994)
Reference: URL:http://xforce.iss.net/xforce/xfdb/68994
foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6
allows remote attackers to execute arbitrary code via a crafted
*FoomaticRIPCommandLine field in a .ppd file, a different
vulnerability than CVE-2011-2697.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
