BugTraq
[ MDVSA-2014:091 ] cups May 16 2014 12:05PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:091
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : cups
Date : May 16, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated cups packages fix security vulnerability:

Cross-site scripting (XSS) vulnerability in scheduler/client.c
in Common Unix Printing System (CUPS) before 1.7.2 allows remote
attackers to inject arbitrary web script or HTML via the URL path,
related to the is_path_absolute function (CVE-2014-2856).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856
http://advisories.mageia.org/MGASA-2014-0193.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
445cf6b0dbd5cf4fa04a69c5d5614272 mbs1/x86_64/cups-1.5.4-1.4.mbs1.x86_64.rpm
33341fd1a29b8e5c252e278a07afda98 mbs1/x86_64/cups-common-1.5.4-1.4.mbs1.x86_64.rpm
16cc85f3d717039ba2d5990b05415a51 mbs1/x86_64/cups-serial-1.5.4-1.4.mbs1.x86_64.rpm
336558ac59995c22c521d852da3e0eea mbs1/x86_64/lib64cups2-1.5.4-1.4.mbs1.x86_64.rpm
29494c6985474246a928b7fae44b5592 mbs1/x86_64/lib64cups2-devel-1.5.4-1.4.mbs1.x86_64.rpm
eff3dcaf0d77d73864802be309a32285 mbs1/x86_64/php-cups-1.5.4-1.4.mbs1.x86_64.rpm
aa8cbd8cf482cac8c56a5c0ba56b8883 mbs1/SRPMS/cups-1.5.4-1.4.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTddTXmqjQ0CJFipgRApH2AKDPLDvdT/zQ8McKsVVsnoZOikoBKQCfWMSM
QGgXeRz9TIFjzB8RJQk25uM=
=RP9f
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus