[ MDVSA-2009:029 ] cups

[dude67]

Security vulnerabilities have been discovered and corrected in CUPS.

CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary
code via a PNG image with a large height value, which bypasses a
validation check and triggers a buffer overflow (CVE-2008-5286).

CUPS shipped with Mandriva Linux allows local users to overwrite
arbitrary files via a symlink attack on the /tmp/pdf.log temporary file
(CVE-2009-0032).

The updated packages have been patched to prevent this.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-5286
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0032
_______________________________________________________________________