CVE-2014-9679

NameCVE-2014-9679
DescriptionInteger underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-159-1, DSA-3172-1
NVD severitymedium (attack range: remote)
Debian Bugs778387

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)wheezy, wheezy (security)1.5.3-5+deb7u6fixed
jessie (security), jessie1.7.5-11+deb8u1fixed
stretch2.2.1-8fixed
buster, sid2.2.5-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssource(unstable)1.7.5-11medium778387
cupssourceexperimental2.0.2-1medium
cupssourcesqueeze1.4.4-7+squeeze7mediumDLA-159-1
cupssourcewheezy1.5.3-5+deb7u5mediumDSA-3172-1

Notes

Marked with [experimental] tag as the fix is only in experimental so far
Switch this to regular fixed version once the fix is in unstable
https://www.cups.org/strfiles.php/3438/str4551.patch
http://www.openwall.com/lists/oss-security/2015/02/10/15

Search for package or bug name: Reporting problems