cups-1.4.2-44.AXS4
エラータID: AXSA:2012-67:01
リリース日:
2012/02/02 Thursday - 15:57
題名:
cups-1.4.2-44.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- CUPS で使用される LZW decompressor には，解凍テーブルに存在しない符号化された文字列を適切に扱っておらず，巧妙に細工された圧縮されたストリームによって，リモートの攻撃者が無限ループやヒープベースのバッファーオーバーフローを引き起こしたり，任意のコードを実行する可能性のある脆弱性があります。(CVE-2011-2896)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2011-2896
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.
追加情報:
N/A
ダウンロード:
SRPMS
- cups-1.4.2-44.AXS4.src.rpm
MD5: 95516646b7aeae5f41b82b9bfd046bbd
SHA-256: 039617d9bf98b0ad9c570d167ccecd3b87af21f4d725316a0fcd20dc6dacc3e6
Size: 4.40 MB
Asianux Server 4 for x86
- cups-1.4.2-44.AXS4.i686.rpm
MD5: de45b4e83582c096de947996b65d9fc2
SHA-256: b6c454a26abe2bd6eed6571e8e599d93d18a5d13bdd7527685055031c587dfc9
Size: 2.28 MB - cups-devel-1.4.2-44.AXS4.i686.rpm
MD5: b6855be894879fbb11e777d4114a0d52
SHA-256: db9833639d16db82249fb2b953ab000289642344ed27dab29717bb2ef81713d6
Size: 106.13 kB - cups-libs-1.4.2-44.AXS4.i686.rpm
MD5: 5420ffc546c4aa18ab14144dee481402
SHA-256: a3be3de909499dbe345b9e097525257a3bcb60d93bbac8c513fad97b5d3f5968
Size: 323.81 kB - cups-lpd-1.4.2-44.AXS4.i686.rpm
MD5: 2e8b39cd5507400bba4c342ed8a22df3
SHA-256: 8cc6867150af265017326fefedfee55022297eae40e1151fcbde80eb7c00535a
Size: 79.21 kB
Asianux Server 4 for x86_64
- cups-1.4.2-44.AXS4.x86_64.rpm
MD5: b4bfb6d0c362d638ae6791f3acccd40f
SHA-256: 941b3387adc8eb3739071a95917f3dd97089dec8c066e96e2307f4a17917ebb4
Size: 2.29 MB - cups-devel-1.4.2-44.AXS4.x86_64.rpm
MD5: 058714b7cb81b38fe73d0a200f58e442
SHA-256: 717b2fd5253c48b09b594f751e1d2adeb6b6cfe01fc0f4148f0fc8f1c05ea066
Size: 105.72 kB - cups-libs-1.4.2-44.AXS4.x86_64.rpm
MD5: acc18b51f1160cc961e9f6a5dbf74170
SHA-256: 9d1fbc95c2997abcf44d668e66c331e5d7031cc1c4cec8f9e606b115607904d1
Size: 313.73 kB - cups-lpd-1.4.2-44.AXS4.x86_64.rpm
MD5: 432ff97ef8bc425c9ef91401beec0ee5
SHA-256: 14116dc61761090a30be8e1409fa58c43e3d57ecaa215a38ed37327f8b40f32c
Size: 78.86 kB - cups-devel-1.4.2-44.AXS4.i686.rpm
MD5: b6855be894879fbb11e777d4114a0d52
SHA-256: db9833639d16db82249fb2b953ab000289642344ed27dab29717bb2ef81713d6
Size: 106.13 kB - cups-libs-1.4.2-44.AXS4.i686.rpm
MD5: 5420ffc546c4aa18ab14144dee481402
SHA-256: a3be3de909499dbe345b9e097525257a3bcb60d93bbac8c513fad97b5d3f5968
Size: 323.81 kB