Red Hat Bugzilla – Bug 441692
CVE-2008-1722 cups: integer overflow in the image filter
Last modified: 2016-03-04 07:42:31 EST
Thomas Pollet reported an integer overflows leading to a heap overflow in the
CUPS' image filter:
img->xsize * img->ysize may overflow (CUPS_IMAGE_MAX_WIDTH and
CUPS_IMAGE_MAX_HEIGHT are too big for multiplication).
malloc(img->xsize * img->ysize * 3) can result in a buffer that's too small.
Upstream patch: http://www.cups.org/strfiles/2790/str2790.patch
Multiple integer overflows in (1) filter/image-png.c and (2)
filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of
service (crash) and trigger memory corruption, as demonstrated via a
crafted PNG image.
This issue affects Red Hat Enterprise Linux 3, 4, and 5.
As for vector (2) - image-zoom.c - is not an issue, according to upstream analysis:
CUPS_IMAGE_MAX_WIDTH is 2^27-1, so it is impossible to overflow on
cups-1.3.7-2.fc8 has been submitted as an update for Fedora 8
cups-1.2.12-11.fc7 has been submitted as an update for Fedora 7
cups-1.3.7-2.fc9 has been submitted as an update for Fedora 9
cups-1.3.7-2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.2.12-11.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.3.7-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in:
Red Hat Enterprise Linux: