Thomas Pollet reported an integer overflows leading to a heap overflow in the CUPS' image filter: http://www.cups.org/str.php?L2790 filter/image-png.c: img->xsize * img->ysize may overflow (CUPS_IMAGE_MAX_WIDTH and CUPS_IMAGE_MAX_HEIGHT are too big for multiplication). malloc(img->xsize * img->ysize * 3) can result in a buffer that's too small. Upstream patch: http://www.cups.org/strfiles/2790/str2790.patch
CVE-2008-1722: Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.
This issue affects Red Hat Enterprise Linux 3, 4, and 5.
As for vector (2) - image-zoom.c - is not an issue, according to upstream analysis: CUPS_IMAGE_MAX_WIDTH is 2^27-1, so it is impossible to overflow on 32-bit systems.
cups-1.3.7-2.fc8 has been submitted as an update for Fedora 8
cups-1.2.12-11.fc7 has been submitted as an update for Fedora 7
cups-1.3.7-2.fc9 has been submitted as an update for Fedora 9
cups-1.3.7-2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.2.12-11.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
cups-1.3.7-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0498.html Fedora: https://admin.fedoraproject.org/updates/F7/FEDORA-2008-3449 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-3586 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-3756