-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-17627 2010-11-11 21:40:27 --------------------------------------------------------------------------------
Name : cups Product : Fedora 12 Version : 1.4.4 Release : 11.fc12 URL : http://www.cups.org/ Summary : Common Unix Printing System Description : The Common UNIX Printing System provides a portable printing layer for UNIX® operating systems. It has been developed by Easy Software Products to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces. -------------------------------------------------------------------------------- Update Information: This update fixes a cupsd memory corruption vulnerability (CVE-2010-2941). -------------------------------------------------------------------------------- ChangeLog: * Thu Nov 11 2010 Tim Waugh <[email protected]> 1:1.4.4-11 - Applied patch to fix cupsd memory corruption vulnerability (CVE-2010-2941, bug #652161). * Fri Oct 15 2010 Tim Waugh <[email protected]> 1:1.4.4-10 - Don't crash when MIME database could not be loaded (bug #610088). * Fri Sep 17 2010 Tim Waugh <[email protected]> 1:1.4.4-9 - Perform locking for gnutls and avoid libgcrypt's broken locking (bug #607159). * Wed Sep 15 2010 Tim Waugh <[email protected]> 1:1.4.4-8 - Build with --enable-threads again (bug #607159). - Force the use of gnutls despite thread-safety concerns (bug #607159). - Fixed serverbin-compat patch to avoid misleading "filter not available" messages (bug #633779). * Fri Aug 20 2010 Tim Waugh <[email protected]> 1:1.4.4-7 - Use better upstream fix for STR #3608 (bug #606909). * Tue Aug 3 2010 Tim Waugh <[email protected]> 1:1.4.4-6 - Specify udevadm trigger action in initscript (bug #623959). - Build requires gnutls-devel not openssl-devel. * Mon Jun 28 2010 Tim Waugh <[email protected]> 1:1.4.4-5 - Avoid empty notify-subscribed-event attributes (bug #606909, STR #3608). * Thu Jun 24 2010 Tim Waugh <[email protected]> 1:1.4.4-4 - Use gnutls again but disable threading (bug #607159). * Tue Jun 22 2010 Tim Waugh <[email protected]> 1:1.4.4-3 - Removed dependency on ghostscript-cups package. The pstoraster filter is not in that package until Fedora 13. * Fri Jun 18 2010 Tim Waugh <[email protected]> 1:1.4.4-2 - Re-enabled SSL support by using OpenSSL instead of gnutls. * Fri Jun 18 2010 Tim Waugh <[email protected]> 1:1.4.4-1 - 1.4.4. Fixes several security vulnerabilities (bug #605399): CVE-2010-0540, CVE-2010-0542, CVE-2010-1748. No longer need str3503, str3399, str3505, str3541, str3425p2 or CVE-2010-0302 patches. - Fix lpd provides. - Added comments for all sources and patches. - Reset status after successful ipp job (bug #548219, STR #3460). - Install udev rules in correct place (bug #530378). - Removed unapplied gnutls-gcrypt-threads patch. Fixed typos in descriptions for lpd and php sub-packages. - Add an SNMP query for Ricoh's device ID OID (STR #3552). - Mark DNS-SD Device IDs that have been guessed at with "FZY:1;". - Add an SNMP query for HP's device ID OID (STR #3552). * Wed Jun 9 2010 Tim Waugh <[email protected]> 1:1.4.3-8 - Use upstream method of handling SNMP quirks in PPDs (STR #3551, bug #581825). * Tue Jun 1 2010 Jiri Popelka <[email protected]> 1:1.4.3-7 - Added back still useful str3425.patch. Second part of STR #3425 is still not fixed in 1.4.3 * Tue May 18 2010 Tim Waugh <[email protected]> 1:1.4.3-6 - Adjust texttops output to be in natural orientation (STR #3563). This fixes page-label orientation when texttops is used in the filter chain (bug #572338). * Thu May 6 2010 Tim Waugh <[email protected]> 1:1.4.3-5 - Use numeric addresses for interfaces unless HostNameLookups are turned on (bug #583054). * Fri Apr 16 2010 Jiri Popelka <[email protected]> 1:1.4.3-4 - Fixed str3541.patch - Added Require: ghostscript (bug #572701) * Tue Apr 13 2010 Tim Waugh <[email protected]> 1:1.4.3-3 - Handle SNMP supply level quirks (bug #581825). * Wed Mar 31 2010 Tim Waugh <[email protected]> 1:1.4.3-2 - Another BrowsePoll fix: handle EAI_NODATA as well (bug #567353). * Wed Mar 31 2010 Jiri Popelka <[email protected]> 1:1.4.3-1 - 1.4.3. - No longer need CVE-2009-3553, str3381, str3390, str3391, str3403, str3407, str3413, str3418, str3422, str3425, str3428, str3431, str3435, str3436, str3439, str3440, str3442, str3448, str3458, str3460, cups-sidechannel-intrs, negative-snmp-string-length, cups-media-empty-warning patches. * Tue Mar 30 2010 Jiri Popelka <[email protected]> 1:1.4.2-30 - Fixed lpstat to adhere to -o option (bug #577901, STR #3541). * Wed Mar 10 2010 Jiri Popelka <[email protected]> 1:1.4.2-29 - Fixed (for the third time) patch for STR #3425 to correctly remove job info files in /var/spool/cups (bug #571830). * Fri Mar 5 2010 Tim Waugh <[email protected]> - 1:1.4.2-28 - Applied patch for CVE-2010-0302 (incomplete fix for CVE-2009-3553, bug #557775). * Tue Mar 2 2010 Tim Waugh <[email protected]> - 1:1.4.2-27 - Don't own filesystem locale directories (bug #569403). - Don't apply gcrypt threading patch (bug #553834). - Don't treat SIGPIPE as an error (bug #569770). * Wed Feb 24 2010 Jiri Popelka <[email protected]> 1:1.4.2-26 - Fixed cupsGetNamedDest() so it falls back to the real default printer when a default from configuration file does not exist (bug #565569, STR #3503). * Tue Feb 23 2010 Tim Waugh <[email protected]> - 1:1.4.2-25 - Update classes.conf when a class member printer is deleted (bug #565878, STR #3505). * Tue Feb 23 2010 Tim Waugh <[email protected]> - 1:1.4.2-24 - Re-initialize the resolver if getnameinfo() returns EAI_AGAIN (bug #567353). * Fri Jan 15 2010 Tim Waugh <[email protected]> - 1:1.4.2-23 - Don't mark initscript as config file. - Use %{_initddir}, %{_sysconfdir} and SMP make flags. - Use mode 0755 for binaries and libraries where appropriate. - Removed use of prereq and buildprereq. - Fixed use of '%' in changelog. - Versioned explicit obsoletes/provides. - Use tabs throughout. - Reset status after successful ipp job (bug #548219, STR #3460). * Thu Jan 14 2010 Tim Waugh <[email protected]> - 1:1.4.2-21 - Install udev rules in correct place (bug #530378). * Wed Dec 23 2009 Tim Waugh <[email protected]> - 1:1.4.2-20 - Fixed patch for STR #3425 again by adding in back-ported change from svn revision 8929 (bug #549899). No longer need delete-active-printer patch. * Tue Dec 22 2009 Tim Waugh <[email protected]> - 1:1.4.2-19 - Fixed ipp authentication for servers requiring authentication for IPP-Get-Printer-Attributes (bug #548873, STR #3458). * Mon Dec 21 2009 Tim Waugh <[email protected]> - 1:1.4.2-18 - Ensure proper thread-safety in gnutls's use of libgcrypt (bug #544619). * Sat Dec 19 2009 Tim Waugh <[email protected]> - 1:1.4.2-17 - Fixed patch for STR #3425 by adding in back-ported change from svn revision 8936 (bug #548904). * Thu Dec 10 2009 Tim Waugh <[email protected]> - 1:1.4.2-16 - Fixed invalid read in cupsAddDest (bug #537460). * Wed Dec 9 2009 Tim Waugh <[email protected]> - 1:1.4.2-15 - Use upstream patch to fix scheduler crash when an active printer was deleted (rev 8914). * Tue Dec 8 2009 Tim Waugh <[email protected]> - 1:1.4.2-14 - The scheduler did not use the Get-Job-Attributes policy for a printer (STR #3431). - The scheduler added two job-name attributes to each job object (STR #3428). - The scheduler did not clean out completed jobs when PreserveJobHistory was turned off (STR #3425). - The web interface did not show completed jobs (STR #3436). - Authenticated printing did not always work when printing directly to a remote server (STR #3435). - Use upstream patch to stop the network backends incorrectly clearing the media-empty-warning state (rev 8896). - Use upstream patch to fix interrupt handling in the side-channel APIs (rev 8896). - Use upstream patch to handle negative SNMP string lengths (rev 8896). - Use upstream fix for SNMP detection (bug #542857, STR #3413). - Use the text filter for text/css files (bug #545026, STR #3442). - Show conflicting option values in web UI (bug #544326, STR #3440). - Use upstream fix for adjustment of conflicting options (bug #533426, STR #3439). - No longer requires paps. The texttopaps filter MIME conversion file is now provided by the paps package (bug #545036). * Tue Dec 8 2009 Tim Waugh <[email protected]> - 1:1.4.2-13 - Moved %{_datadir}/cups/ppdc/*.h to the main package (bug #545348). * Fri Dec 4 2009 Tim Waugh <[email protected]> - 1:1.4.2-12 - The web interface prevented conflicting options from being adjusted (bug #533426, STR #3439). * Thu Dec 3 2009 Tim Waugh <[email protected]> - 1:1.4.2-11 - Fixes for SNMP scanning with Lexmark printers (bug #542857, STR #3413). * Mon Nov 23 2009 Tim Waugh <[email protected]> 1:1.4.2-10 - Undo last change as it was incorrect. * Mon Nov 23 2009 Tim Waugh <[email protected]> 1:1.4.2-9 - Fixed small typos introduced in fix for bug #536741. * Fri Nov 20 2009 Jiri Popelka <[email protected]> 1:1.4.2-8 - Do not translate russian links showing completed jobs (bug #539354, STR #3422). * Thu Nov 19 2009 Tim Waugh <[email protected]> 1:1.4.2-7 - Applied patch to fix CVE-2009-3553 (bug #530111, STR #3200). * Tue Nov 17 2009 Tim Waugh <[email protected]> 1:1.4.2-6 - Fixed display of current driver (bug #537182, STR #3418). - Fixed out-of-memory handling when loading jobs (bug #538054, STR #3407). * Mon Nov 16 2009 Tim Waugh <[email protected]> 1:1.4.2-5 - Fixed typo in admin web template (bug #537884, STR #3403). - Reset SIGPIPE handler for child processes (bug #537886, STR #3399). * Mon Nov 16 2009 Tim Waugh <[email protected]> 1:1.4.2-4 - Upstream fix for GNU TLS error handling bug (bug #537883, STR #3381). * Wed Nov 11 2009 Jiri Popelka <[email protected]> 1:1.4.2-3 - Fixed lspp-patch to avoid memory leak (bug #536741). * Tue Nov 10 2009 Tim Waugh <[email protected]> 1:1.4.2-2 - Added explicit version dependency on cups-libs to cups-lpd (bug #502205). * Tue Nov 10 2009 Tim Waugh <[email protected]> 1:1.4.2-1 - 1.4.2. No longer need str3380, str3332, str3356, str3396 patches. - Removed postscript.ppd.gz (bug #533371). - Renumbered patches and sources. -------------------------------------------------------------------------------- References: [ 1 ] Bug #624438 - CVE-2010-2941 cups: cupsd memory corruption vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=624438 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update cups' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/package-announce
