Bug 732106 (CVE-2011-3170) - CVE-2011-3170 cups: gif_read_lzw() does not properly handle first code word in an LZW stream, which may lead to arbitrary code execution
Summary: CVE-2011-3170 cups: gif_read_lzw() does not properly handle first code word i...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2011-3170
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 732107
Blocks: 732110
TreeView+ depends on / blocked
 
Reported: 2011-08-19 19:45 UTC by Vincent Danen
Modified: 2021-02-24 14:53 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-08-24 05:40:21 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2011-08-19 19:45:09 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3170 to
the following vulnerability:

Name: CVE-2011-3170
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3170
Assigned: 20110819
Reference: http://cups.org/str.php?L3914
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=727800

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896.
Comment 1 Vincent Danen 2011-08-19 19:47:27 UTC 
Created cups tracking bugs for this issue

Affects: fedora-all [bug 732107]
Comment 2 Vincent Danen 2011-08-19 19:48:41 UTC 
Fixed upstream in r9865.
Comment 3 Tomas Hoger 2011-08-19 20:18:51 UTC 
This is what we have mentioned in bug #727800, comment #8.  Sounds like an incomplete CVE-2011-2896 fix id to me.
Comment 4 Vincent Danen 2011-08-19 20:24:52 UTC 
Yes, I think you're right on that count.
Comment 5 Vincent Danen 2011-08-19 20:26:15 UTC 
Statement:

Not affected.  This flaw was introduced in CUPS due to an incomplete fix for CVE-2011-2896, which was not applied to any CUPS packages in Red Hat Enterprise Linux.
Note You need to log in before you can comment on or make changes to this bug.