Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

openSUSE Leap 42.3: 2018:2239-1 Moderate: CUPS Security Update

opensuse
Calendar Grey August 7, 2018
Scroller Opensuse
An openSUSE patch addressing 5 moderate-severity issues in CUPS has been released, including resolutions for vulnerabilities that could allow local privilege escalation.
An update that solves 5 vulnerabilities and has two fixes is now available.

Description

This update for cups fixes the following issues:

The following security vulnerabilities were fixed:

- CVE-2017-18248: Handle invalid characters properly in printing jobs.

This fixes a problem that was causing the DBUS library to abort the

calling process. (bsc#1061066 bsc#1087018)

- Fixed a local privilege escalation to root and sandbox bypasses in the

scheduler

- CVE-2018-4180: Fixed a local privilege escalation to root in dnssd

backend (bsc#1096405)

- CVE-2018-4181: Limited local file reads as root via cupsd.conf include

directive (bsc#1096406)

- CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling

(bsc#1096407)

- CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration

(bsc#1096408)

The following other issue was fixed:

- Fixed authorization check for clients (like samba) connected through the

local socket when Kerberos authentication is enabled (bsc#1050082)

This update was...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate local privilege escalation security fix cups authorization openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-822=1

Package List

- openSUSE Leap 42.3 (i586 x86_64):

cups-1.7.5-12.6.1

cups-client-1.7.5-12.6.1

cups-client-debuginfo-1.7.5-12.6.1

cups-ddk-1.7.5-12.6.1

cups-ddk-debuginfo-1.7.5-12.6.1

cups-debuginfo-1.7.5-12.6.1

cups-debugsource-1.7.5-12.6.1

cups-devel-1.7.5-12.6.1

cups-libs-1.7.5-12.6.1

cups-libs-debuginfo-1.7.5-12.6.1

- openSUSE Leap 42.3 (x86_64):

cups-libs-32bit-1.7.5-12.6.1

cups-libs-debuginfo-32bit-1.7.5-12.6.1

References

https://www.suse.com/security/cve/CVE-2017-18248.html

https://www.suse.com/security/cve/CVE-2018-4180.html

https://www.suse.com/security/cve/CVE-2018-4181.html

https://www.suse.com/security/cve/CVE-2018-4182.html

https://www.suse.com/security/cve/CVE-2018-4183.html

https://bugzilla.suse.com/1050082

https://bugzilla.suse.com/1061066

https://bugzilla.suse.com/1087018

https://bugzilla.suse.com/1096405

https://bugzilla.suse.com/1096406

https://bugzilla.suse.com/1096407

https://bugzilla.suse.com/1096408

--

Announcement ID: openSUSE-SU-2018:2239-1
Rating: moderate
Affected Products: openSUSE Leap 42.3 le.

Topics%20covered

Topics Covered

security advisory moderate local privilege escalation security fix cups authorization openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.