cups-filters: CVE-2015-8560: code execution via improper escaping of ; in foomatic-rip

Debian Bug report logs - #807930
cups-filters: CVE-2015-8560: code execution via improper escaping of ; in foomatic-rip

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: TEMP-0000000-166C73 code execution via improper escaping of ; in foomatic-rip

Date: Mon, 14 Dec 2015 15:45:31 +0100

Package: cups-filters
Severity: important
Tags: security upstream

There is a patch upstream for this vulnerability:
https://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7419.

Message #10 received at 807930@bugs.debian.org (full text, mbox, reply):

From: Didier 'OdyX' Raboud <odyx@debian.org>

To: Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>, 807930@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: Bug#807930: TEMP-0000000-166C73 code execution via improper escaping of ; in foomatic-rip

Date: Mon, 14 Dec 2015 16:30:06 +0100

[Message part 1 (text/plain, inline)]

Control: tags -1 +patch +upstream +fixed-upstream

Le lundi, 14 décembre 2015, 15.45:31 Yann Soubeyrand a écrit :
> There is a patch upstream for this vulnerability:
> https://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7419.

Thanks for the hint.

I'm likely to wait for 1.4.0 upstream release for an upload to unstable, 
and will then prepare the package for jessie (if the Security Team 
agrees).

Cheers,
OdyX

[7419_7418.diff (text/x-patch, attachment)]

Message #31 received at 807930@bugs.debian.org (full text, mbox, reply):

From: Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>

To: 807930@bugs.debian.org

Subject: Re: cups-filters: code execution via improper escaping of ; in foomatic-rip

Date: Mon, 14 Dec 2015 18:15:59 +0100

[Message part 1 (text/plain, inline)]

Attached is the upstream patch with proper DEP-3 headers.

If you need help to prepare the packages for Jessie and Wheezy, feel
free to ask me ;-)

Cheers

[TEMP-0000000-166C73.patch (text/x-patch, attachment)]

Message #36 received at 807930@bugs.debian.org (full text, mbox, reply):

From: Till Kamppeter <till.kamppeter@gmail.com>

To: Didier 'OdyX' Raboud <odyx@debian.org>, 807930@bugs.debian.org, Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>, Debian Security Team <team@security.debian.org>

Subject: Re: Bug#807930: TEMP-0000000-166C73 code execution via improper escaping of ; in foomatic-rip

Date: Mon, 14 Dec 2015 21:55:48 -0200

On 12/14/2015 01:30 PM, Didier 'OdyX' Raboud wrote:
> I'm likely to wait for 1.4.0 upstream release for an upload to unstable,
> and will then prepare the package for jessie (if the Security Team
> agrees).

I have 1.4.0 released upstream now, including the fix. I have also 
updated the Debian packaging on the Debian GIT repository now, so that 
the package is ready for upload.

   Till

Message #43 received at 807930-close@bugs.debian.org (full text, mbox, reply):

From: Didier Raboud <odyx@debian.org>

To: 807930-close@bugs.debian.org

Subject: Bug#807930: fixed in cups-filters 1.4.0-1

Date: Tue, 15 Dec 2015 10:39:29 +0000

Source: cups-filters
Source-Version: 1.4.0-1

We believe that the bug you reported is fixed in the latest version of
cups-filters, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 807930@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Didier Raboud <odyx@debian.org> (supplier of updated cups-filters package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 15 Dec 2015 11:04:23 +0100
Source: cups-filters
Binary: libcupsfilters1 libfontembed1 cups-filters cups-filters-core-drivers libcupsfilters-dev libfontembed-dev cups-browsed
Architecture: source
Version: 1.4.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Didier Raboud <odyx@debian.org>
Description:
 cups-browsed - OpenPrinting CUPS Filters - cups-browsed
 cups-filters - OpenPrinting CUPS Filters - Main Package
 cups-filters-core-drivers - OpenPrinting CUPS Filters - PPD-less printing
 libcupsfilters-dev - OpenPrinting CUPS Filters - Development files for the library
 libcupsfilters1 - OpenPrinting CUPS Filters - Shared library
 libfontembed-dev - OpenPrinting CUPS Filters - Development files for font embed libr
 libfontembed1 - OpenPrinting CUPS Filters - Font Embed Shared library
Closes: 807930
Changes:
 cups-filters (1.4.0-1) unstable; urgency=medium
 .
   * New upstream release
    - foomatic-rip: SECURITY FIX: Also consider the semicolon (';') as an
      illegal shell escape character. Thanks to Adam Chester for the hint
      (CVE-2015-8560, Closes: #807930)
    - Added support for Braille embossing via CUPS
 .
   [ Till Kamppeter ]
   * Changes for the upstream addition of the Braille embosser drivers
   * Moved the implicitclass backend from the cups-filters into the cups-browsed
     binary package as it is used by cups-browsed (and so already needed by a
     level-1 printing stack)
   * Added dependencies on imagemagick (>= 6.4~), liblouisutdml-bin, and
     poppler-utils to cups-filters, as they are needed to convert images, text,
     and PDF to Braille, added antiword and docx2txt to Suggests: as they allow
     converting Word files to Braille
Checksums-Sha1:
 e420d8a3e0de0a4f03295c0da632d3b0551c16df 2727 cups-filters_1.4.0-1.dsc
 05280371296d708974309a2870d516444169b2b8 1373724 cups-filters_1.4.0.orig.tar.xz
 c032b05ac03486ddff374a524b145929a682c6c2 68484 cups-filters_1.4.0-1.debian.tar.xz
Checksums-Sha256:
 59df22fcc039952296886cab5e2e492f142204dd65a186f1a7f7987741fcba75 2727 cups-filters_1.4.0-1.dsc
 0aa63f82a3feb5c46136b917722ee1565b4c1e2e533db4716f62d31e29c6579a 1373724 cups-filters_1.4.0.orig.tar.xz
 7714a20c1526198c70c9ffd99b1a4190b241a717dd2ad2028d1efc4d55d1d4f3 68484 cups-filters_1.4.0-1.debian.tar.xz
Files:
 546244f433e5128deb57775d0910247a 2727 net optional cups-filters_1.4.0-1.dsc
 9dc532a710c21ac2c063d07465b93d0b 1373724 net optional cups-filters_1.4.0.orig.tar.xz
 9a0267b9d9cfb8f4b8a327e757890396 68484 net optional cups-filters_1.4.0-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQGcBAEBCgAGBQJWb+o0AAoJEIvPpx7KFjRVbvML/0/8dIoQ88UtjZdq9wN5OLQP
0VaMkXV54BowwNQ+MaZ3hLjJfWhxX6dKAMnpin6qmbRoVaXDEOYsgogkh7ankxv4
U6XNBNPLGkPgNiR8dZFyQFxZyAMi+td3rttyonT3FsLLFqztCBO7X5KkdgI3IKhj
JQ80yJd7Jv/tOzxaPpRyewAajKgBJhLYGWIbCq43pAik/dtDWrO26Am8Ygi06WaX
D/8cWy9gqDNg/ujOh4w4R3uWL3AIIeL0lY+YA2gZlVvDEcSS6hNTqAWXxVKrZrfu
xgl9j4gsTm+Ke5zcVyoBUXXUwKivomFiDisI7EnPDImTuRdfm+4LNYiQvKA7NDXM
Sc1DftQbfWblAl4A5REFIFr+Azx8LNuC/w71GF58d+R0yoDpTF82LE0jAI+QBHR9
9gAb1RmC5oNleCkhvPZf7q69BrZTnUb0oh4VHRQQyAsek+b8YfGldJ6I/SAveJKp
UxBYHuZrkQvwfnlliI467fM7LwZqLPTGkSZArpk1kQ==
=i/go
-----END PGP SIGNATURE-----

Message #48 received at 807930@bugs.debian.org (full text, mbox, reply):

From: Didier 'OdyX' Raboud <odyx@debian.org>

To: debian-printing@lists.debian.org, Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>, 807930@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: Bug#807930: cups-filters: code execution via improper escaping of ; in foomatic-rip

Date: Tue, 15 Dec 2015 11:48:19 +0100

[Message part 1 (text/plain, inline)]

Hi Yann,

Le lundi, 14 décembre 2015, 18.15:59 Yann Soubeyrand a écrit :
> Attached is the upstream patch with proper DEP-3 headers.
> 
> If you need help to prepare the packages for Jessie and Wheezy, feel
> free to ask me ;-)

Thanks for the offer. I'm fine preparing the uploads myself. :)

Security Team: Can I upload a cups-filters version corresponding to the 
attached debdiff?

Yann: That said, if you have a more general interest in printing-related 
concerns, I'd happily on-board you in the Debian Printing Team.

Cheers,
OdyX

[cups-filters_1.0.61-5+deb8u3.debdiff (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #53 received at 807930@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Didier 'OdyX' Raboud <odyx@debian.org>

Cc: debian-printing@lists.debian.org, Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>, 807930@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: Bug#807930: cups-filters: code execution via improper escaping of ; in foomatic-rip

Date: Tue, 15 Dec 2015 12:24:29 +0100

[Message part 1 (text/plain, inline)]

Hi Didier,

On Tue, Dec 15, 2015 at 11:48:19AM +0100, Didier 'OdyX' Raboud wrote:
> Hi Yann,
> 
> Le lundi, 14 décembre 2015, 18.15:59 Yann Soubeyrand a écrit :
> > Attached is the upstream patch with proper DEP-3 headers.
> > 
> > If you need help to prepare the packages for Jessie and Wheezy, feel
> > free to ask me ;-)
> 
> Thanks for the offer. I'm fine preparing the uploads myself. :)
> 
> Security Team: Can I upload a cups-filters version corresponding to the 
> attached debdiff?

With urgency=highg set please go ahead with the upload to
security-master.

Regards,
Salvatore

[signature.asc (application/pgp-signature, inline)]

Message #58 received at 807930@bugs.debian.org (full text, mbox, reply):

From: Didier 'OdyX' Raboud <odyx@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: Yann Soubeyrand <yann-externe.soubeyrand@edf.fr>, 807930@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: Bug#807930: cups-filters: code execution via improper escaping of ; in foomatic-rip

Date: Tue, 15 Dec 2015 14:20:19 +0100

[Message part 1 (text/plain, inline)]

Le mardi, 15 décembre 2015, 12.24:29 Salvatore Bonaccorso a écrit :
> With urgency=high set please go ahead with the upload to
> security-master.

Uploaded, thanks.

Cheers,
OdyX

[signature.asc (application/pgp-signature, inline)]

Message #63 received at 807930-close@bugs.debian.org (full text, mbox, reply):

From: Didier Raboud <odyx@debian.org>

To: 807930-close@bugs.debian.org

Subject: Bug#807930: fixed in cups-filters 1.0.61-5+deb8u3

Date: Sun, 20 Dec 2015 17:17:28 +0000

Source: cups-filters
Source-Version: 1.0.61-5+deb8u3

We believe that the bug you reported is fixed in the latest version of
cups-filters, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 807930@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Didier Raboud <odyx@debian.org> (supplier of updated cups-filters package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 15 Dec 2015 13:23:43 +0100
Source: cups-filters
Binary: libcupsfilters1 libfontembed1 cups-filters cups-filters-core-drivers libcupsfilters-dev libfontembed-dev cups-browsed
Architecture: source amd64
Version: 1.0.61-5+deb8u3
Distribution: jessie-security
Urgency: high
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Didier Raboud <odyx@debian.org>
Description:
 cups-browsed - OpenPrinting CUPS Filters - cups-browsed
 cups-filters - OpenPrinting CUPS Filters - Main Package
 cups-filters-core-drivers - OpenPrinting CUPS Filters - PPD-less printing
 libcupsfilters-dev - OpenPrinting CUPS Filters - Development files for the library
 libcupsfilters1 - OpenPrinting CUPS Filters - Shared library
 libfontembed-dev - OpenPrinting CUPS Filters - Development files for font embed libr
 libfontembed1 - OpenPrinting CUPS Filters - Font Embed Shared library
Closes: 807930
Changes:
 cups-filters (1.0.61-5+deb8u3) jessie-security; urgency=high
 .
   * Backport upstream fixes to also consider the semicolon (';') as an illegal
     shell escape character (CVE-2015-8560, Closes: #807930)
Checksums-Sha1:
 f47255dea67f3c0dc9d2abf37f75fc945cff1206 2718 cups-filters_1.0.61-5+deb8u3.dsc
 f98f70ecf69dab54a139c7ed2cf726c9e66a2686 68160 cups-filters_1.0.61-5+deb8u3.debian.tar.xz
 f3471fed40b36db43c857b4ba179683e5357238d 106378 libcupsfilters1_1.0.61-5+deb8u3_amd64.deb
 e598081e3e7d8a7e2c451dd89ac3ac424db2da69 73448 libfontembed1_1.0.61-5+deb8u3_amd64.deb
 ca86d30e353378b6796bdbcd2b000647af942d07 506982 cups-filters_1.0.61-5+deb8u3_amd64.deb
 25376b3891d6d3866b5a34a47b24adb14726fad3 141360 cups-filters-core-drivers_1.0.61-5+deb8u3_amd64.deb
 f2e83904069a45f4d674a556794c9196d688cf37 113194 libcupsfilters-dev_1.0.61-5+deb8u3_amd64.deb
 80c0c47111aea99ace753c6953fedd6ff1047c22 76314 libfontembed-dev_1.0.61-5+deb8u3_amd64.deb
 e876642f6ce3a873b43a930dbc5129365be24744 79218 cups-browsed_1.0.61-5+deb8u3_amd64.deb
Checksums-Sha256:
 845c0e2e5b0a995ffeaf3711a46e4499f6e809915b442189b041184a262e61df 2718 cups-filters_1.0.61-5+deb8u3.dsc
 d8f9e0dbaa0621acd7798446c7000a7134e47133789e3b85434f2b528826518d 68160 cups-filters_1.0.61-5+deb8u3.debian.tar.xz
 c88e651a43778c185e444954ac3dd36ab94e5c3cd4827931f94b241d2c1ebca3 106378 libcupsfilters1_1.0.61-5+deb8u3_amd64.deb
 dacc1d9755f3d074fba3aa98dec4135ac0f28043d1407c62db2af6aae45dfa2c 73448 libfontembed1_1.0.61-5+deb8u3_amd64.deb
 5863b75b1140f2968eb06c35d581dab1a6b439d46d476d98b809e9e1f5a7cafe 506982 cups-filters_1.0.61-5+deb8u3_amd64.deb
 a89e2b62961d63d160b8d686c8e0c95414d6a96d9c3228bd384e038075fc1c2f 141360 cups-filters-core-drivers_1.0.61-5+deb8u3_amd64.deb
 46b0df541ed8cc5721510298964a7189edb895a5b93c9e1e4e3e71bd74648b39 113194 libcupsfilters-dev_1.0.61-5+deb8u3_amd64.deb
 2514958151e80cd28df9c94e42d8fd671aaa4a23a6e84477f7247f0729ae87aa 76314 libfontembed-dev_1.0.61-5+deb8u3_amd64.deb
 34f36057094ba4ea2a4b66ce94c2c39bb299d4ad0c3405dfc5ce51e7a5448742 79218 cups-browsed_1.0.61-5+deb8u3_amd64.deb
Files:
 42b6034696c05f2d5efe6291392ed9f7 2718 net optional cups-filters_1.0.61-5+deb8u3.dsc
 0c50528e578ac96a0561625e81d041c1 68160 net optional cups-filters_1.0.61-5+deb8u3.debian.tar.xz
 9479c18707e377ce7f7045b024decd4f 106378 libs optional libcupsfilters1_1.0.61-5+deb8u3_amd64.deb
 fd121e74edb90c7dfad04631b1bf4eca 73448 libs optional libfontembed1_1.0.61-5+deb8u3_amd64.deb
 91322c8661b1d603fc8f12e6acca85e4 506982 net optional cups-filters_1.0.61-5+deb8u3_amd64.deb
 1edb1eb3ae1f784b0db2b52d2fc4000d 141360 net optional cups-filters-core-drivers_1.0.61-5+deb8u3_amd64.deb
 bd2c264ca16dc87ca9260d2cc4905c63 113194 libdevel optional libcupsfilters-dev_1.0.61-5+deb8u3_amd64.deb
 de08662977d135026ac85396210dbd65 76314 libdevel optional libfontembed-dev_1.0.61-5+deb8u3_amd64.deb
 a48f10190babf52451b525d9c2a4b180 79218 net optional cups-browsed_1.0.61-5+deb8u3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQGcBAEBCgAGBQJWcBFSAAoJEIvPpx7KFjRV/MoL/0hV5aysch4gmDfQpLdu7Mvt
WJYtxLWQMpSphnA3U/Qq3wUsuFRj+/MvJ5vM4mItDlmL61LJU3gWmD/fSbUXGHut
qyHizyOiRJqx/WbcEhaGgeB41Hu4SL6orGxO+oo9rFUdaiTdCr2bNszaCo0oHxxq
ab5X+Sonx4qAvW6oM4XaGhKPGF6zpiMxDuWOkP3AHErn4UqP5kfG8VLvHY68ABhP
rRrCTNJqY9NIqKXUJ/Wcrg2jIKsTV7iwGsX7OJK/AKbdRIALymvHdz+iW01TCGun
5DkWhLKciBhtgatKS7bZVbO31maLwhfJnMm7A1u5K+tVq8VteEMvPZP8CpFeQf2W
v+9ZWxfZ0MpL6xLA5VZpQPDp0+nAFZBb3I8LUrMpNEz5NOSpqm2rgBdlxdnqVeB9
63auip2NN13b0EDuqydLGzYUdcTUru8IfEhZVuhnME1Q3E7ct4K1OF0smgNkhoYr
GNXoQbCS8MEuS51P5rSrK+JKwUJS5qxlGhcVZJ/X8A==
=XurY
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.