Univention Bugzilla – Bug 50838
cups: Multiple issues (4.4)
Last modified: 2020-03-11 14:41:49 CET
New Debian cups 2.2.1-8+deb9u5A~4.4.3.202002191052 fixes: This update addresses the following issue: * In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196 (CVE-2019-2228)
--- mirror/ftp/4.4/unmaintained/4.4-2/source/cups_2.2.1-8+deb9u4A~4.4.0.201909100952.dsc +++ apt/ucs_4.4-0-errata4.4-3/source/cups_2.2.1-8+deb9u5A~4.4.3.202002191052.dsc @@ -1,4 +1,4 @@ -2.2.1-8+deb9u4A~4.4.0.201909100952 [Tue, 10 Sep 2019 09:52:22 +0200] Univention builddaemon <buildd@univention.de>: +2.2.1-8+deb9u5A~4.4.3.202002191052 [Wed, 19 Feb 2020 10:53:06 +0100] Univention builddaemon <buildd@univention.de>: * UCS auto build. The following patches have been applied to the original source package 00-autostart-setting @@ -9,6 +9,12 @@ 15_postponed-univention-lpadmin-systemd 20_no-on-demand-systemd-service +2.2.1-8+deb9u5 [Sun, 19 Jan 2020 09:53:03 +0100] Didier Raboud <odyx@debian.org>: + + * Backport upstream security fix: + - CVE-2019-2228: The `ippSetValuetag` function did not validate the + default language value (Closes: #946782) + 2.2.1-8+deb9u4 [Wed, 21 Aug 2019 09:51:54 +0200] Didier Raboud <odyx@debian.org>: * Fix multiple security/disclosure issues (Closes: #934957) <http://10.200.17.11/4.4-3/#7310349038143009793>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-3] 62b55f3f04 Bug #50838: cups 2.2.1-8+deb9u5A~4.4.3.202002191052 doc/errata/staging/cups.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) [4.4-3] 1f3df17809 Bug #50838: cups 2.2.1-8+deb9u5A~4.4.3.202002191052 doc/errata/staging/cups.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
<http://errata.software-univention.de/ucs/4.4/458.html>