Bug 587746 (CVE-2010-0542)

Summary: CVE-2010-0542 CUPS: texttops unchecked memory allocation failure leading to NULL pointer dereference
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: jlieskov, security-response-team, twaugh, vdanen, ykopkova
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-07-27 05:23:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 590075, 590076, 590077, 590078, 590079, 590080, 605399    
Bug Blocks:    
Attachments:
Description Flags
Proposed patch from Apple
none
updated patch for 1.3.7 none

Description Josh Bressers 2010-04-30 19:05:30 UTC 
A NULL pointer dereference issue exists in the _WriteProlog function of the
texttops image filter. The return value from calloc is not checked. This
may lead to a NULL pointer dereference. Since the offset from the pointer
at which data is subsequently written is controlled by the user, this issue
may lead to application termination or arbitrary code execution.
Comment 2 Josh Bressers 2010-04-30 19:10:52 UTC 
Created attachment 410579 [details]
Proposed patch from Apple
Comment 8 Vincent Danen 2010-05-06 21:06:38 UTC 
Created attachment 412171 [details]
updated patch for 1.3.7
Comment 17 Vincent Danen 2010-05-25 23:37:40 UTC 
Acknowledgements:

Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges regenrecht as the original reporter.
Comment 20 Vincent Danen 2010-06-17 20:06:06 UTC 
This is public now via the CUPS 1.4.4 release:

http://cups.org/str.php?L3516
http://cups.org/articles.php?L596

They don't mention the CVE names, however.
Comment 21 Vincent Danen 2010-06-17 20:39:51 UTC 
Created cups tracking bugs for this issue

Affects: fedora-all [bug 605399]
Comment 22 errata-xmlrpc 2010-06-17 22:18:51 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html
Comment 23 Fedora Update System 2010-06-18 11:03:29 UTC 
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc13
Comment 24 Fedora Update System 2010-06-18 11:04:20 UTC 
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc12
Comment 25 Fedora Update System 2010-06-18 11:05:25 UTC 
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc11
Comment 26 Fedora Update System 2010-06-24 12:22:39 UTC 
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-4.fc13
Comment 27 Fedora Update System 2010-06-25 18:10:29 UTC 
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 28 Fedora Update System 2010-07-01 18:44:28 UTC 
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 29 Fedora Update System 2010-07-27 02:45:44 UTC 
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.