cups: multiple vulnerabilities
| Package(s): | cups | CVE #(s): | CVE-2010-2431 CVE-2010-2432 | ||||||||||||||||||||||||||||||||
| Created: | July 8, 2010 | Updated: | October 10, 2011 | ||||||||||||||||||||||||||||||||
| Description: | From the Pardus advisory: CVE-2010-2431: The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file. CVE-2010-2432: The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||