Executive Summary
Summary | |
---|---|
Title | foomatic security update |
Informations | |||
---|---|---|---|
Name | RHSA-2016:0491 | First vendor Publication | 2016-03-22 |
Vendor | RedHat | Last vendor Modification | 2016-03-22 |
Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: An updated foomatic package that fixes three security issues is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code. (CVE-2010-5325) It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. (CVE-2015-8327, CVE-2015-8560) All foomatic users should upgrade to this updated package, which contains backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1218297 - CVE-2010-5325 foomatic: potential remote arbitrary code execution 1287523 - CVE-2015-8327 cups-filters: foomatic-rip did not consider the back tick as an illegal shell escape character 1291227 - CVE-2015-8560 cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2016-0491.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-04-22 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-690.nasl - Type : ACT_GATHER_INFO |
2016-03-24 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160323_foomatic_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2016-03-24 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0040.nasl - Type : ACT_GATHER_INFO |
2016-03-24 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2016-0491.nasl - Type : ACT_GATHER_INFO |
2016-03-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-0491.nasl - Type : ACT_GATHER_INFO |
2016-03-23 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2016-0491.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2015-a108c34086.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2015-998911cf3f.nasl - Type : ACT_GATHER_INFO |
2016-01-25 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-67.nasl - Type : ACT_GATHER_INFO |
2016-01-14 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-0112-1.nasl - Type : ACT_GATHER_INFO |
2016-01-14 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-0092-1.nasl - Type : ACT_GATHER_INFO |
2015-12-29 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-954.nasl - Type : ACT_GATHER_INFO |
2015-12-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3429.nasl - Type : ACT_GATHER_INFO |
2015-12-21 | Name : The remote Debian host is missing a security update. File : debian_DLA-371.nasl - Type : ACT_GATHER_INFO |
2015-12-18 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_7329938ba4e611e5b86414dae9d210b8.nasl - Type : ACT_GATHER_INFO |
2015-12-18 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_6dbae1a8a4e611e5b86414dae9d210b8.nasl - Type : ACT_GATHER_INFO |
2015-12-17 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2838-2.nasl - Type : ACT_GATHER_INFO |
2015-12-17 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2838-1.nasl - Type : ACT_GATHER_INFO |
2015-12-16 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3419.nasl - Type : ACT_GATHER_INFO |
2015-12-10 | Name : The remote Debian host is missing a security update. File : debian_DLA-365.nasl - Type : ACT_GATHER_INFO |
2015-12-08 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2831-2.nasl - Type : ACT_GATHER_INFO |
2015-12-08 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2831-1.nasl - Type : ACT_GATHER_INFO |
2015-12-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3411.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-04-15 21:36:04 |
|
2016-04-14 21:30:27 |
|
2016-03-25 13:26:21 |
|
2016-03-24 13:25:50 |
|
2016-03-23 00:22:42 |
|