Debian Cups vulnerabilities

CVE-2005-3625 [CRITICAL] CVE-2005-3625: cups - Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, l... Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins." Scope: local bookworm: resolved (fixed in 1.1.22-7) bullseye: resolved

CVE-2005-0206 [CRITICAL] CVE-2005-0206: cups - The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-088... The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities. Scope: local bookworm: resolved (fixed in 1.1.22-7) bullseye: resolved (fixed in 1.1.22-7) forky: resolved (fixed in 1.1.22-7) si

CVE-2005-3628 [HIGH] CVE-2005-3628: cups - Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xp... Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors. Scope: local bookworm: resolved (fixed in 1.1.22-7) bullseye: resolved (fixed in 1.1.22-7) f

CVE-2005-4873 [HIGH] CVE-2005-4873: cups - Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23r... Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitrary code via vectors that result in long function parameters, as demonstrated by the cups_get_dest_options function in phpcups.c. Scope: local bookworm: resolved (fixed in 1.1.23-10sarge1) bullseye: resolved (fixed in 1.1.23-10sarge1

CVE-2005-0064 [HIGH] CVE-2005-0064: cups - Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.0... Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value. Scope: local bookworm: resolved (fixed in 1.1.22-6) bullseye: resolved (fixed in 1.1.22-6) forky: resolved (fixed in 1.1.22-6) sid: resolved (fixed in 1.1.22-6) trixie

CVE-2005-3627 [HIGH] CVE-2005-3627: cups - Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, t... Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index

CVE-2005-3626 [MEDIUM] CVE-2005-3626: cups - Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, l... Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference. Scope: local bookworm: resolved (fixed in 1.1.22-7) bullseye: resolved (fixed in 1.1.22-7) forky: resolved (fixed in 1.1.22-7) sid: resolved (fix

CVE-2005-2874 [MEDIUM] CVE-2005-2874: cups - The is_path_absolute function in scheduler/client.c for the daemon in CUPS befor... The is_path_absolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service (CPU consumption by tight loop) via a "..\.." URL in an HTTP request. Scope: local bookworm: resolved (fixed in 1.1.23-1) bullseye: resolved (fixed in 1.1.23-1) forky: resolved (fixed in 1.1.23-1) sid: resolved (fixed in 1.1.23-1

CVE-2005-3624 [MEDIUM] CVE-2005-3624: cups - The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, p... The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows. Scope: local bookworm: resolved (fixed in 1.1.22-7) bullseye: resolved (fixed in 1

CVE-2005-3192 [HIGH] CVE-2005-3192: cups - Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used... Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field. Scope: local bookworm: resolved (fixed i

CVE-2005-2097 [LOW] CVE-2005-2097: cups - xpdf and kpdf do not properly validate the "loca" table in PDF files, which allo... xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information. Scope: local bookworm: resolved (fixed in 1.1.22-7) bullseye: resolved (fixed

CVE-2005-3193 [MEDIUM] CVE-2005-3193: cups - Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX ... Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF f

CVE-2005-3191 [MEDIUM] CVE-2005-3191: cups - Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF an... Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial

CVE-2004-0888 [CRITICAL] CVE-2004-0888: cups - Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf... Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889. Scope: local bookworm: resolved (fixed in 1.1.22-6) bullseye: resolved (fi

CVE-2004-1125 [CRITICAL] CVE-2004-1125: cups - Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other ... Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded

CVE-2004-0558 [MEDIUM] CVE-2004-0558: cups - The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows... The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port. Scope: local bookworm: resolved (fixed in 1.1.20final+rc1-6) bullseye: resolved (fixed in 1.1.20final+rc1-6) forky: resolved (fixed in 1.1.20final+rc1-6) sid: resolved (fixed in 1.1.20fin

CVE-2004-1269 [MEDIUM] CVE-2004-1269: cups - lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a f... lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subsequent invocations of lppasswd to fail. Scope: local bookworm: resolved (fixed in 1.1.22-2) bullseye: resolved (fixed in 1.1.22-2) forky: resolved (fixed in 1.1.22-2) sid: resolved (fixed in 1.1.22-2) trixie: resolved (fi

CVE-2004-1267 [MEDIUM] CVE-2004-1267: cups - Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops pro... Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops program for CUPS 1.1.22 allows remote attackers to execute arbitrary code via a crafted HPGL file. Scope: local bookworm: resolved (fixed in 1.1.22-2) bullseye: resolved (fixed in 1.1.22-2) forky: resolved (fixed in 1.1.22-2) sid: resolved (fixed in 1.1.22-2) trixie: resolved (fixed in 1.1.22-

CVE-2004-0923 [LOW] CVE-2004-0923: cups - CUPS 1.1.20 and earlier records authentication information for a device URI in t... CUPS 1.1.20 and earlier records authentication information for a device URI in the error_log file, which allows local users to obtain user names and passwords. Scope: local bookworm: resolved (fixed in 1.1.20final+rc1-9) bullseye: resolved (fixed in 1.1.20final+rc1-9) forky: resolved (fixed in 1.1.20final+rc1-9) sid: resolved (fixed in 1.1.20final+rc1-9) trixie: resolved

CVE-2004-2154 [CRITICAL] CVE-2004-2154: cups - CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitiv... CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive. Scope: local bookworm: resolved (fixed in 1.1.20final+rc1-1) bullseye: resolved (fixed in 1.1.20final+rc1-1) forky: re