Bug 587746 (CVE-2010-0542) - CVE-2010-0542 CUPS: texttops unchecked memory allocation failure leading to NULL pointer dereference
Summary: CVE-2010-0542 CUPS: texttops unchecked memory allocation failure leading to N...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-0542
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 590075 590076 590077 590078 590079 590080 605399
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-30 19:05 UTC by Josh Bressers
Modified: 2019-09-29 12:36 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-07-27 05:23:48 UTC


Attachments (Terms of Use)
Proposed patch from Apple (1.46 KB, patch)
2010-04-30 19:10 UTC, Josh Bressers
no flags Details | Diff
updated patch for 1.3.7 (860 bytes, patch)
2010-05-06 21:06 UTC, Vincent Danen
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0490 normal SHIPPED_LIVE Important: cups security update 2010-06-17 22:18:30 UTC
CUPS Bugs and Features 3516 None None None Never

Description Josh Bressers 2010-04-30 19:05:30 UTC
A NULL pointer dereference issue exists in the _WriteProlog function of the
texttops image filter. The return value from calloc is not checked. This
may lead to a NULL pointer dereference. Since the offset from the pointer
at which data is subsequently written is controlled by the user, this issue
may lead to application termination or arbitrary code execution.

Comment 2 Josh Bressers 2010-04-30 19:10:52 UTC
Created attachment 410579 [details]
Proposed patch from Apple

Comment 8 Vincent Danen 2010-05-06 21:06:38 UTC
Created attachment 412171 [details]
updated patch for 1.3.7

Comment 17 Vincent Danen 2010-05-25 23:37:40 UTC
Acknowledgements:

Red Hat would like to thank the Apple Product Security team for responsibly reporting this issue. Upstream acknowledges regenrecht as the original reporter.

Comment 20 Vincent Danen 2010-06-17 20:06:06 UTC
This is public now via the CUPS 1.4.4 release:

http://cups.org/str.php?L3516
http://cups.org/articles.php?L596

They don't mention the CVE names, however.

Comment 21 Vincent Danen 2010-06-17 20:39:51 UTC
Created cups tracking bugs for this issue

Affects: fedora-all [bug 605399]

Comment 22 errata-xmlrpc 2010-06-17 22:18:51 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0490 https://rhn.redhat.com/errata/RHSA-2010-0490.html

Comment 23 Fedora Update System 2010-06-18 11:03:29 UTC
cups-1.4.4-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc13

Comment 24 Fedora Update System 2010-06-18 11:04:20 UTC
cups-1.4.4-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc12

Comment 25 Fedora Update System 2010-06-18 11:05:25 UTC
cups-1.4.4-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/cups-1.4.4-1.fc11

Comment 26 Fedora Update System 2010-06-24 12:22:39 UTC
cups-1.4.4-4.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/cups-1.4.4-4.fc13

Comment 27 Fedora Update System 2010-06-25 18:10:29 UTC
cups-1.4.4-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 28 Fedora Update System 2010-07-01 18:44:28 UTC
cups-1.4.4-5.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 29 Fedora Update System 2010-07-27 02:45:44 UTC
cups-1.4.4-5.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.