lp:ubuntu/lucid-security/cups

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

31. By Marc Deslauriers on 2012-12-03

* SECURITY UPDATE: privilege escalation via config file editing
  - debian/patches/CVE-2012-5519.dpatch: split configuration file into
    two, to isolate options that have a security impact.
  - debian/cups.install: also install cups-files.conf
  - debian/patches/removecvstag.dpatch: updated to remove tag from
    cups-files.conf.
  - CVE-2012-5519

30. By Marc Deslauriers on 2011-09-12

* SECURITY UPDATE: arbitrary code execution via missing code words
  - debian/patches/CVE-2011-2896.dpatch: improve logic in
    filter/image-gif.c.
  - CVE-2011-2896
* SECURITY UPDATE: arbitrary code execution via incorrect code word
  handling
  - debian/patches/CVE-2011-3170.dpatch: don't overflow in
    filter/image-gif.c.
  - CVE-2011-3170
* This update does _not_ contain the changes from the 1.4.3-1ubuntu1.4
  package that was in -proposed.

29. By Marc Deslauriers on 2010-11-02

* SECURITY UPDATE: denial of service and possible code execution via
  invalid free
  - debian/patches/CVE-2010-2941.dpatch: skip over and reserve unused
    tags in cups/ipp.{c,h}.
  - CVE-2010-2941

28. By Marc Deslauriers on 2010-06-18

* SECURITY UPDATE: cross-site request forgery in admin interface
  - debian/patches/CVE-2010-0540.dpatch: add unpredictable session token
    to cgi-bin/cgi.h, cgi-bin/libcupscgi.exp, cgi-bin/template.c,
    cgi-bin/var.c, templates/*.tmpl.
  - CVE-2010-0540
* SECURITY UPDATE: denial of service or arbitrary code execution in
  texttops image filter
  - debian/patches/CVE-2010-0542.dpatch: make sure calloc succeeded in
    filter/texttops.c.
  - CVE-2010-0542
* SECURITY UPDATE: web interface memory disclosure
  - debian/patches/CVE-2010-1748.dpatch: validate data in cgi-bin/var.c.
  - CVE-2010-1748
* SECURITY UPDATE: file overwrite vulnerability
  - debian/patches/security-str3510.dpatch: introduce cups_open() in
    cups/file.c and use to make sure hard-linked or symlinked files don't
    get overwritten as root.
  - No CVE number
* debian/libcupscgi1.symbols: Add new symbols

27. By Martin Pitt on 2010-04-09

[ Till Kamppeter ]
* debian/filters/pstopdf: Use "-dUseCIEColor" for the Ghostscript call in the
  pstopdf filter, to eliminate the warning "Set UseCIEColor for
  UseDeviceIndependentColor to work properly.".

[ Martin Pitt ]
* New upstream bug fix release. See http://www.cups.org/articles.php?L594
  for details.
* Drop CVE-2010-0393.dpatch, upstream now.
* Update usb-backend-both-usblp-and-libusb.dpatch for new version.
* select_use_after_free.dpatch: Add additional fix by Tim Waugh and Vincent
  Danen for CVE-2010-0302, and update tag header. (Closes: #572940)

26. By Martin Pitt on 2010-03-24

[ Till Kamppeter ]
* debian/local/filters/pdf-filters/pdftopdf/P2PDoc.cxx: Output of the
  pdftopdf filter was not completely complying with the Adobe specs for PDF.
  Thanks to Duncan Lock for finding and reporting the bug and supplying a
  fix (LP: #544636).

[ Martin Pitt ]
* Add no-conffile-timestamp.dpatch: Disable time stamps in conffiles, to
  avoid ever-changing files in /etc. Thanks Joey Hess!
  (Rejected upstream, STR#3067; Closes: #549673)
* CVE-2010-0393.dpatch: Replace with patch from upstream, and tag
  header. (Closes: #572940)
* debian/local/filters/pdf-filters/*: Disable call of setErrorFunction() on
  armel for now, since armel's libpoppler is broken. This works around
  #575262, so that cups can finally go into testing again (which is more
  than overdue).

25. By Martin Pitt on 2010-02-18

* debian/control: Build depend on virtual libjpeg-dev package only.
  (Closes: #570381)
* debian/cups.init.d: Fix syntax error which caused coldplug_usb_printers()
  to needlessly run udev-configure-printer for all USB devices.
* Bump Standards-Version to 3.8.4 (no changes necesssary).
* debian/libcupscgi1.symbols: Add new symbol from 1.4.2.
* debian/cups.init.d: Add missing $remote_fs dependency.

24. By Till Kamppeter on 2010-02-11

[ Till Kamppeter ]
* dynamic-default-ripcache-size.dpatch: Fixed the copy of thr new function
  cupsdDefaultRIPCacheSize() which goes into the cupsfilter utility. It did
  not return its result and made cupsfilter segfaulting independent of the
  input (LP: #442283).

[ Martin Pitt ]
* debian/control: Update libjpeg62-dev build/binary dependency to
  libjpeg8-dev | libjpeg-dev. (Closes: #569230)
* Acknowledge Bdale Garbee's NMU to work around bad pdftotext behaviour due
  to a bug in ttf-freefont. This has been worked around in texttopdf itself
  in the previous upload (see LP #447961). (Closes: #519643)

23. By Martin Pitt on 2010-01-27

[ Till Kamppeter ]
* debian/local/filters/pdf-filters/filter/texttopdf.c: Workaround for
  bug in ttf-freefont which messed up the output of the texttopdf filter.
  Thanks to Hin-Tak Leung and Steve White to find this solution (LP: #447961).
* debian/local/filters/pdf-filters/pdftopdf/P2PDoc.cxx,
  debian/local/filters/pdf-filters/pdftopdf/P2PGfx.cxx,
  debian/local/filters/pdf-filters/pdftopdf/P2PGfx.h,
  debian/local/filters/pdf-filters/pdftopdf/P2PObject.h,
  debian/local/filters/pdf-filters/pdftopdf/P2POutput.cxx: Upstream
  fix from Koji Otani for the following: (1) Fixed some memory leak;
  (2) pdftopdf now delays fetching a referenced object until when it is
  written to the output. This fixes memory hogging with N-up output
  (N pages per sheet). The fix is mainly done by (2). This fixes
  LP: #508731.

[ Martin Pitt ]
* manpage-translations.dpatch: Update to German manpage translations, thanks
  Helge Kreutzmann! (Closes: #502908)
* debian/cups.postinst: Do not symlink snakeoil SSL certificate if
  server.{crt,key} already exist as broken symlinks. Thanks Andreas
  Büsching! (Closes: #554579)

22. By Martin Pitt on 2009-12-21

[ Till Kamppeter ]
* Urgency medium, this only fixes a highly visible crash.
* debian/local/filters/pdf-filters/pdftopdf/P2PGfx.cxx: Fixed segfault of
  the pdftopdf filter when the input PDF file has ICC-profile-based color
  space inline images. Thanks to Koji Otani for the fix. Fixes:
  LP: #407344, LP: #466119, LP: #467919, LP: #475330, LP: #488752.

[ Martin Pitt ]
* debian/rules: Have a failed test suite fail the build on Ubuntu again,
  buildds were fixed. (LP: #447919)