PT-2008-1011 · Apple+1 · Libcupsys2-Gnutls10+2

Published 2008-03-18 · Updated 2017-09-29 · CVE-2008-0053

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CUPS versions prior to 1.3.6 cups versions prior to 1.2.12-r7 libcupsys2-gnutls10 (affected versions not specified)

Description The issue is related to multiple buffer overflows in the HP-GL/2-to-PostScript filter, which might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file. Additionally, there are multiple vulnerabilities in the libcupsys2-gnutls10 and cups packages that can lead to violations of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For CUPS versions prior to 1.3.6, update to version 1.3.6 or later. For cups versions prior to 1.2.12-r7, update to version 1.2.12-r7 or later. For libcupsys2-gnutls10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-01436

BDU:2015-09622

CVE-2008-0053

DSA-1625-1

RHSA-2008:0192

RHSA-2008:0206

RHSA-2008_0192

RHSA-2008_0206

Affected Products

Cups

Red Hat

Libcupsys2-Gnutls10

References · 44

• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00003.html · Vendor Advisory
• http://secunia.com/advisories/29655 · Vendor Advisory
• http://secunia.com/advisories/29659 · Vendor Advisory
• http://secunia.com/advisories/29630 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0053 · Vendor Advisory
• http://secunia.com/advisories/29634 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-0053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0053 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1373 · Security Note
• http://security.gentoo.org/glsa/glsa-200804-01.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09622 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0192.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1625 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0206.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1722 · Security Note