Bug 587746 - (CVE-2010-0542) CVE-2010-0542 CUPS: texttops unchecked memory allocation failure leading to NULL pointer dereference
CVE-2010-0542 CUPS: texttops unchecked memory allocation failure leading to N...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
public=20100617,reported=20100430,sou...
: Security
Depends On: 590075 590076 590077 590078 590079 590080 605399
Blocks:
  Show dependency treegraph
 
Reported: 2010-04-30 15:05 EDT by Josh Bressers
Modified: 2016-03-04 06:02 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-07-27 01:23:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch from Apple (1.46 KB, patch)
2010-04-30 15:10 EDT, Josh Bressers
no flags Details | Diff
updated patch for 1.3.7 (860 bytes, patch)
2010-05-06 17:06 EDT, Vincent Danen
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
CUPS Bugs and Features 3516 None None None Never

  None (edit)
Description Josh Bressers 2010-04-30 15:05:30 EDT
A NULL pointer dereference issue exists in the _WriteProlog function of the
texttops image filter. The return value from calloc is not checked. This
may lead to a NULL pointer dereference. Since the offset from the pointer
at which data is subsequently written is controlled by the user, this issue
may lead to application termination or arbitrary code execution.
Comment 2 Josh Bressers 2010-04-30 15:10:52 EDT
Created attachment 410579 [details]
Proposed patch from Apple
Comment 8 Vincent Danen 2010-05-06 17:06:38 EDT
Created attachment 412171 [details]
updated patch for 1.3.7
Comment 17 Vincent Danen 2010-05-25 19:37:40 EDT
Acknowledgements:

Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges regenrecht as the original reporter.
Comment 20 Vincent Danen 2010-06-17 16:06:06 EDT
This is public now via the CUPS 1.4.4 release:

http://cups.org/str.php?L3516
http://cups.org/articles.php?L596

They don't mention the CVE names, however.
Comment 21 Vincent Danen 2010-06-17 16:39:51 EDT
Created cups tracking bugs for this issue

Affects: fedora-all [bug 605399]
Comment 22 errata-xmlrpc 2010-06-17 18:18:51 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html
Comment 23 Fedora Update System 2010-06-18 07:03:29 EDT
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc13
Comment 24 Fedora Update System 2010-06-18 07:04:20 EDT
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc12
Comment 25 Fedora Update System 2010-06-18 07:05:25 EDT
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc11
Comment 26 Fedora Update System 2010-06-24 08:22:39 EDT
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-4.fc13
Comment 27 Fedora Update System 2010-06-25 14:10:29 EDT
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 28 Fedora Update System 2010-07-01 14:44:28 EDT
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 29 Fedora Update System 2010-07-26 22:45:44 EDT
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.