Bug 732106 - (CVE-2011-3170) CVE-2011-3170 cups: gif_read_lzw() does not properly handle first code word in an LZW stream, which may lead to arbitrary code execution
CVE-2011-3170 cups: gif_read_lzw() does not properly handle first code word i...
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 732107
Blocks: 732110
  Show dependency treegraph
Reported: 2011-08-19 15:45 EDT by Vincent Danen
Modified: 2011-08-24 01:40 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2011-08-24 01:40:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2011-08-19 15:45:09 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3170 to
the following vulnerability:

Name: CVE-2011-3170
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3170
Assigned: 20110819
Reference: http://cups.org/str.php?L3914
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=727800

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896.
Comment 1 Vincent Danen 2011-08-19 15:47:27 EDT
Created cups tracking bugs for this issue

Affects: fedora-all [bug 732107]
Comment 2 Vincent Danen 2011-08-19 15:48:41 EDT
Fixed upstream in r9865.
Comment 3 Tomas Hoger 2011-08-19 16:18:51 EDT
This is what we have mentioned in bug #727800, comment #8.  Sounds like an incomplete CVE-2011-2896 fix id to me.
Comment 4 Vincent Danen 2011-08-19 16:24:52 EDT
Yes, I think you're right on that count.
Comment 5 Vincent Danen 2011-08-19 16:26:15 EDT

Not affected.  This flaw was introduced in CUPS due to an incomplete fix for CVE-2011-2896, which was not applied to any CUPS packages in Red Hat Enterprise Linux.

Note You need to log in before you can comment on or make changes to this bug.