cupsys 1.3.7-1ubuntu3.3 source package in Ubuntu

Changelog

cupsys (1.3.7-1ubuntu3.3) hardy-security; urgency=low

  * SECURITY UPDATE: denial of service by adding a large number of RSS
    subscriptions (LP: #298241)
    - debian/patches/CVE-2008-5183.dpatch: gracefully handle MaxSubscriptions
      being reached in scheduler/{ipp.c,subscriptions.c}.
    - CVE-2008-5183
  * SECURITY UPDATE: unauthorized access to RSS subscription functions in
    web interface (LP: #298241)
    - debian/patches/CVE-2008-5184.dpatch: make sure user is authenticated
      in /cgi-bin/admin.c.
    - CVE-2008-5184
  * SECURITY UPDATE: arbitrary code execution via integer overflow from a PNG
    image with a large height value
    - This issue was introduced in the patch for CVE-2008-1722.
    - debian/patches/CVE-2008-1722.dpatch: adjust patch to multiply img->xsize
      instead of img->ysize so we don't overflow in filter/image-png.c.
    - CVE-2008-5286
  * SECURITY UPDATE: arbitrary file overwrite via temp log file symlink attack
    - debian/filters/pstopdf: use the cleaned-up version from Debian.
    - CVE-2008-5377

 -- Marc Deslauriers <email address hidden>   Thu, 08 Jan 2009 10:29:38 -0500