cups-pk-helper security vulnerability CVE-2012-4510

Thanks for your debdiffs!

The quantal patch should use 0.2.1.2-1ubuntu1.1 as the version per https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging. Otherwise it looks great. I'm fixing that and uploading to the security ppa now.

The precise patch should use 0.2.1.2-1ubuntu0.1 as the version per https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging. Otherwise it looks great. I'm also fixing that and uploading to the security ppa now.

The oneiric patch should use 0.1.2-1ubuntu0.1 as the version per https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging. Otherwise it looks great. Once again, I'm fixing that and uploading to the security ppa now.

Jeremy, can you comment on the testing performed?

The only testing I've done is testing that it builds successfully. I don't have any test code to make sure that the patch fixes the vulnerability.

Jeremy, would you be able to at least install the packages and smoke test them?

Incidentally, I am asking for this because the Fedora patch for Oneiric was against a different version and so was the upstream patches used for precise and quantal. I verified the patches against upstream and visually inspected them to make sure they were ok, but all of them applied with offsets. I'd like some confirmation that the package still works.

Pocket copied cups-pk-helper to proposed. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance!

To ubuntu-sru: if this passes the verification process, please also pocket copy to security. Thanks!

I have this package already installed for some weeks on my Quantal system as I have -proposed activated. system-config-printer works correctly for me, so there should be no regressions.

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

This bug was fixed in the package cups-pk-helper - 0.2.1.2-1ubuntu0.1

---------------
cups-pk-helper (0.2.1.2-1ubuntu0.1) precise-security; urgency=low

  * SECURITY UPDATE: CUPS function calls were wrapped insecurely, which
    could be used to upload sensitive data to a CUPS resource, or overwrite
    specific files with the content of a CUPS resource. The user would have
    to explicitly approve the action. (LP: #1083416)
    - CVE-2012-4510
    - debian/patches/CVE-2012-4510-part1.patch: Copied from git
    - debian/patches/CVE-2012-4510-part2.patch: Copied from git
 -- Jeremy Bicha <email address hidden> Mon, 26 Nov 2012 22:34:18 -0500

Also copied to precise-security, as requested.

This bug was fixed in the package cups-pk-helper - 0.1.2-1ubuntu0.1

---------------
cups-pk-helper (0.1.2-1ubuntu0.1) oneiric-security; urgency=low

  * SECURITY UPDATE: CUPS function calls were wrapped insecurely, which
    could be used to upload sensitive data to a CUPS resource, or overwrite
    specific files with the content of a CUPS resource. The user would have
    to explicitly approve the action. (LP: #1083416)
    - CVE-2012-4510
    - debian/patches/cups-pk-helper-CVE-2012-4510.patch: Copied from Fedora 16
 -- Jeremy Bicha <email address hidden> Mon, 26 Nov 2012 22:39:36 -0500

This bug was fixed in the package cups-pk-helper - 0.2.1.2-1ubuntu1.1

---------------
cups-pk-helper (0.2.1.2-1ubuntu1.1) quantal-security; urgency=low

  * SECURITY UPDATE: CUPS function calls were wrapped insecurely, which
    could be used to upload sensitive data to a CUPS resource, or overwrite
    specific files with the content of a CUPS resource. The user would have
    to explicitly approve the action. (LP: #1083416)
    - CVE-2012-4510
    - debian/patches/CVE-2012-4510-part1.patch: Copied from git
    - debian/patches/CVE-2012-4510-part2.patch: Copied from git
 -- Jeremy Bicha <email address hidden> Mon, 26 Nov 2012 22:12:08 -0500