Version in base suite: 1.2.7-4etch6 Version in overlay suite: (not present) Base version: cupsys_1.2.7-4etch6 Target version: cupsys_1.2.7-4etch7 Base file: /org/ftp.debian.org/ftp/pool/main/c/cupsys/cupsys_1.2.7-4etch6.dsc Target file: /org/ftp.debian.org/queue/o-p-u-new/cupsys_1.2.7-4etch7.dsc cupsys-1.2.7/debian/changelog | 8 ++++++++ cupsys-1.2.7/debian/patches/00list | 1 + debian/patches/82_CVE-2009-0163.dpatch | 19 +++++++++++++++++++ 3 files changed, 28 insertions(+) diff -u cupsys-1.2.7/debian/changelog cupsys-1.2.7/debian/changelog --- cupsys-1.2.7/debian/changelog +++ cupsys-1.2.7/debian/changelog @@ -1,3 +1,11 @@ +cupsys (1.2.7-4etch7) oldstable-security; urgency=low + + * Add 82_CVE-2009-0163.dpatch: Fix integer overflow induced heap buffer + overflow in the _cupsImageReadTIFF() function. Discovered by iDefense. + (CVE-2009-0163) + + -- Martin Pitt Sat, 04 Apr 2009 06:01:47 -0700 + cupsys (1.2.7-4etch6) stable-security; urgency=high * Non-maintainer upload by the security team diff -u cupsys-1.2.7/debian/patches/00list cupsys-1.2.7/debian/patches/00list --- cupsys-1.2.7/debian/patches/00list +++ cupsys-1.2.7/debian/patches/00list @@ -55,0 +56 @@ +82_CVE-2009-0163.dpatch only in patch2: unchanged: --- cupsys-1.2.7.orig/debian/patches/82_CVE-2009-0163.dpatch +++ cupsys-1.2.7/debian/patches/82_CVE-2009-0163.dpatch @@ -0,0 +1,19 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 81_CVE-2009-0163.dpatch by Martin Pitt +## +## DP: Fix integer overflow induced heap buffer overflow in the +## DP: _cupsImageReadTIFF() function. Discovered by iDefense. [CVE-2009-0163] +@DPATCH@ +--- a/filter/image-private.h 2007-07-11 14:46:42.000000000 -0700 ++++ b/filter/image-private.h 2009-04-04 05:54:00.045486999 -0700 +@@ -41,8 +41,8 @@ + + # define CUPS_IMAGE_MAX_WIDTH 0x07ffffff + /* 2^27-1 to allow for 15-channel data */ +-# define CUPS_IMAGE_MAX_HEIGHT 0x7fffffff +- /* 2^31-1 */ ++# define CUPS_IMAGE_MAX_HEIGHT 0x3fffffff ++ /* 2^30-1 */ + + # define CUPS_TILE_SIZE 256 /* 256x256 pixel tiles */ + # define CUPS_TILE_MINIMUM 10 /* Minimum number of tiles */