PT-2009-6728 · Apple+3 · Cups-Libs-X86+11

Braden Thomas + 1 · Publicado 1970-01-01 · Atualizado 2019-03-06 · CVE-2009-0166

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cups versions prior to 1.3.10 cups-libs (affected versions not specified) cups-libs-32bit (affected versions not specified) cups-libs-x86 (affected versions not specified) cups-client (affected versions not specified) cups-debuginfo (affected versions not specified) cups-debugsource (affected versions not specified) cups-devel (affected versions not specified) kdegraphics-3.5.4 (affected versions not specified) kdegraphics-devel-3.5.4 (affected versions not specified) Xpdf version 3.02pl2 and earlier

Description The issue concerns multiple vulnerabilities in various packages, including cups and kdegraphics, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, allows remote attackers to cause a denial of service via a crafted PDF file.

Recommendations For cups versions prior to 1.3.10, update to version 1.3.10 or later. For cups-libs, cups-libs-32bit, cups-libs-x86, cups-client, cups-debuginfo, cups-debugsource, and cups-devel, there is no information about a newer version that contains a fix for this vulnerability. For kdegraphics-3.5.4 and kdegraphics-devel-3.5.4, there is no information about a newer version that contains a fix for this vulnerability. For Xpdf version 3.02pl2 and earlier, update to a version later than 3.02pl2. As a temporary workaround, consider disabling the JBIG2 decoder function until a patch is available.

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-399

CWE-119

Identificadores relacionados

BDU:2015-04161

BDU:2015-04162

BDU:2015-04163

BDU:2015-04164

BDU:2015-04165

BDU:2015-04166

BDU:2015-04167

BDU:2015-04168

BDU:2015-06216

BDU:2015-06220

BDU:2015-08480

BDU:2015-08481

BDU:2015-09375

CVE-2009-0166

DSA-1790-1

DSA-1793-1

RHSA-2009:0429

RHSA-2009:0430

RHSA-2009:0431

RHSA-2009:0458

RHSA-2009:0480

RHSA-2009_0429

RHSA-2009_0430

RHSA-2009_0431

RHSA-2009_0458

RHSA-2009_0480

RHSA-2010:0399

RHSA-2010:0400

RHSA-2010_0399

RHSA-2010_0400

Produtos afetados

Red Hat

Xpdf

Cups

Cups-Client

Cups-Debuginfo

Cups-Debugsource

Cups-Devel

Cups-Libs

Cups-Libs-32Bit

Cups-Libs-X86

Kdegraphics

Kdegraphics-Devel

Referências · 116

• https://bdu.fstec.ru/vul/2015-04167 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2009-3606 · Nota
• http://vupen.com/english/advisories/2010/1040 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200904-20.xml · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2009:0480 · Nota
• http://wiki.rpath.com/Advisories:rPSA-2009-0061 · Nota
• http://redhat.com/support/errata/RHSA-2009-0429.html · Correção, Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9778 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447081 · Nota
• http://debian.org/security/2009/dsa-1793 · Correção, Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-00992 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2010-0739 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3609 · Nota
• https://bdu.fstec.ru/vul/2015-04165 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0166 · Aviso do Fabricante