Security World: [SECURITY] [DSA 1933-1] New cups packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1933-1 security@debian.org
http://www.debian.org/security/ Steffen Joeris
November 10, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : cups
Vulnerability : missing input sanitising
Problem type : remote
Debian-specific: no
CVE Id : CVE-2009-2820

Aaron Siegel discovered that the web interface of cups, the Common UNIX
Printing System, is prone to cross-site scripting attacks.

For the stable distribution (lenny), this problem has been fixed in
version 1.3.8-1+lenny7.

For the oldstable distribution (etch), this problem has been fixed in
version 1.2.7-4+etch9.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem will be fixed soon.

We recommend that you upgrade your cups packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7.orig.tar.gz
Size/MD5 checksum: 4214272 c9ba33356e5bb93efbcf77b6e142e498
http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4+etch9.diff.gz
Size/MD5 checksum: 112995 fe3566daa6615bcd625288ce98e9384f
http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4+etch9.dsc
Size/MD5 checksum: 1095 804241054cda1301d183492ea5969649

Architecture independent packages:

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-common_1.2.7-4+etch9_all.deb
Size/MD5 checksum: 917720 bc97c75dacbd345dfd07e9397c91c38f
http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-gnutls10_1.2.7-4+etch9_all.deb
Size/MD5 checksum: 46524 4f95c2485efda6dc7fc306162a5b1641

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 192380 fac2ee8208cc62269d660293987722c4
http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 46336 537bf35bd49b91a743511ae655ea98fa
http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 106222 41d7dfbd5f5f8989c491dd7c6256d23c
http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 1773934 ed2f57b9532dfdd17a487cc794674254
http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 204566 e0b3ae3cb6dcf554600cd8a6282f31c3
http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 1109732 dc2117102927617da49909c68a4c010d
http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 107490 e755ddc16e79d95f5e717cdda6b8b66a
http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4+etch9_ia64.deb
Size/MD5 checksum: 74382 2625f53f6a81c275e6b3600b6f83e40e

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 89456 ce774884f9f2d60d53b9738087b1997c
http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 41338 6470a2c554400bf5d76df57a10c59b1a
http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 163538 f312c95edac480e335383282e658afa4
http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 1148886 2867ed7850c711eb45802ee198667b6c
http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 136252 ead19e10b92e029542cf17b378a567fc
http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 89566 03ad548ff0f04c960eb4f242dc46251d
http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 51924 f25670cf80cd3d7558da75c315305725
http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4+etch9_powerpc.deb
Size/MD5 checksum: 1584292 238dcd774ade788f8bd22094c45a1330

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8-1+lenny7.diff.gz
Size/MD5 checksum: 188585 2f134119c9ab17213747ad55cd3abdf5
http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8.orig.tar.gz
Size/MD5 checksum: 4796827 10efe9825c1a1dcd325be47a6cc21faf
http://security.debian.org/pool/updates/main/c/cups/cups_1.3.8-1+lenny7.dsc
Size/MD5 checksum: 1838 598e0194241cb4b10e6ea6264c620f11

Architecture independent packages:

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkr40h0ACgkQ62zWxYk/rQcmrQCfT/1a/+FSdezaW1pc/iHM/jLN
jrgAoI1qnCASB/CO/zVZea8yTWpEXuc+
=mK8e
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Monday, November 09, 2009

[SECURITY] [DSA 1933-1] New cups packages fix cross-site scripting

No comments:

Post a Comment