Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow.

Updated cups-filters packages fix security vulnerabilities :

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6473).

Florian Weimer discovered that cups-filters incorrectly handled memory in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6474, CVE-2013-6475).

Florian Weimer discovered that cups-filters did not restrict driver directories in in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6476).

Sebastian Krahmer discovered it was possible to use malicious broadcast packets to execute arbitrary commands on a server running the cups-browsed daemon (CVE-2014-2707).

In cups-filters before 1.0.53, out-of-bounds accesses in the process_browse_data function when reading the packet variable could leading to a crash, thus resulting in a denial of service (CVE-2014-4337).

In cups-filters before 1.0.53, if there was only a single BrowseAllow line in cups-browsed.conf and its host specification was invalid, this was interpreted as if no BrowseAllow line had been specified, which resulted in it accepting browse packets from all hosts (CVE-2014-4338).

The CVE-2014-2707 issue with malicious broadcast packets, which had been fixed in Mageia Bug 13216 (MGASA-2014-0181), had not been completely fixed by that update. A more complete fix was implemented in cups-filters 1.0.53 (CVE-2014-4336).

Note that only systems that have enabled the affected feature by using the CreateIPPPrinterQueues configuration directive in /etc/cups/cups-browsed.conf were affected by the CVE-2014-2707 / CVE-2014-4336 issue.

The remote host is affected by the vulnerability described in GLSA-201406-16 (cups-filters: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cups-filters. Please       review the CVE identifiers referenced below for more details about the       vulnerabilities.
  Impact :

    A remote attacker(s) could possibly execute arbitrary code utilizing       multiple attack vectors, or a local attacker could gain escalated       privileges via a specially crafted shared library.
  Workaround :

    There is no known workaround at this time.

This update removes unused pdftoopvp and urftopdf filters.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer of the Red Hat Product Security Team discovered multiple vulnerabilities in the pdftoopvp CUPS filter, which could result in the execution of aribitrary code if a malformed PDF file is processed.

Florian Weimer discovered that the pdftoopvp filter bundled in the CUPS package incorrectly handled memory. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. (CVE-2013-6474, CVE-2013-6475)

Florian Weimer discovered that the pdftoopvp filter bundled in the CUPS package did not restrict driver directories. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. (CVE-2013-6476).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. This issue only affected Ubuntu 13.10. (CVE-2013-6473)

Florian Weimer discovered that cups-filters incorrectly handled memory in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user.
(CVE-2013-6474, CVE-2013-6475)

Florian Weimer discovered that cups-filters did not restrict driver directories in in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. (CVE-2013-6476).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82353	Mandriva Linux Security Advisory : cups-filters (MDVSA-2015:100)	Nessus	Mandriva Local Security Checks	high
76084	GLSA-201406-16 : cups-filters: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
73044	Fedora 20 : cups-filters-1.0.41-5.fc20 (2014-3738)	Nessus	Fedora Local Security Checks	medium
72991	Debian DSA-2876-1 : cups - security update	Nessus	Debian Local Security Checks	medium
72990	Debian DSA-2875-1 : cups-filters - security update	Nessus	Debian Local Security Checks	medium
72979	Ubuntu 10.04 LTS : cups vulnerabilities (USN-2144-1)	Nessus	Ubuntu Local Security Checks	medium
72978	Ubuntu 12.04 LTS / 12.10 / 13.10 : cups-filters vulnerabilities (USN-2143-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-6475

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium