|
|
| |
|
| |
cups: multiple vulnerabilities
| Package(s): | cups |
CVE #(s): | CVE-2010-2431
CVE-2010-2432
|
| Created: | July 8, 2010 |
Updated: | October 10, 2011 |
| Description: |
From the Pardus advisory:
CVE-2010-2431:
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with
lp group membership, to overwrite arbitrary files via a symlink attack
on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache
file.
CVE-2010-2432:
The cupsDoAuthentication function in auth.c in the client in CUPS before
1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand
for authorization, which allows remote CUPS servers to cause a denial of
service (infinite loop) via HTTP_UNAUTHORIZED responses.
|
| Alerts: |
|
( Log in to post comments)
|
|
|