Bug 3582 - Security Advisory - cups - CVE-2011-2896
Summary: Security Advisory - cups - CVE-2011-2896
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 1.4
Hardware: x86 Multiple
: Medium normal
Target Milestone: Future
Assignee: Li Wang
QA Contact:
URL:
Whiteboard: P3
Depends on:
Blocks:
 
Reported: 2012-12-13 07:17 UTC by Li Wang
Modified: 2013-03-01 11:04 UTC (History)
7 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Li Wang 2012-12-13 07:17:48 UTC 
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2896
Comment 1 Ross Burton 2013-03-01 11:04:18 UTC 
Integrated into master and will be in 1.3.1.