Common Vulnerabilities and Exposures originally assigned an identifier CVE-2008-1722 to the following vulnerability: Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image. It was discovered, the original patch for this issue was incomplete and integer overflow in filter/image-png.c was still present. This could allow an attacker to cause a denial of service (crash) via a crafted PNG image. References: http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt http://www.cups.org/str.php?L2974 Patch: http://www.cups.org/strfiles/2974/str2974.patch
Description from the CVE entry: Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.
This issue does not affect systems where CUPS uses libpng version 1.2.6rc1 (released in Aug 2004) or later, as libpng itself imposes limits on maximum width and height of the image (quoting libpng's CHANGES file): Imposed default one million column, one-million row limits on the image dimensions, and added png_set_user_limits() function to override them. Due to this check, images with size that could cause integer overflow in the bufsize check are rejected earlier in the image processing. Therefore, this issue did not affect CUPS versions as shipped in Red Hat Enterprise Linux 4 and 5 and current Fedora versions, as they all use version of libpng newer than 1.2.6rc1. libpng limits in the version shipped in Red Hat Enterprise Linux 3 are much higher and do not prevent this possible overflow.
This flaw was addressed upstream in 1.3.10: http://www.cups.org/articles.php?L582
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-1028.html