Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a long job title.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2016-162:01 advisory.

    Foomatic is a comprehensive, spooler-independent database of printers,     printer drivers, and driver descriptions. It contains utilities to     generate driver description files and printer queues for CUPS, LPD,     LPRng, and PDQ using the database. There is also the possibility to     read the PJL options out of PJL-capable laser printers and take them     into account at the driver description file generation.
    There are spooler-independent command line interfaces to manipulate     queues (foomatic-configure) and to print files/manipulate jobs     (foomatic printjob).
    The site http://www.linuxprinting.org/ is based on this database.
    Security issues fixed with this release:
    CVE-2010-5325
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-8327     Incomplete blacklist vulnerability in util.c in foomatic-rip in     cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic     4.0.x allows remote attackers to execute arbitrary commands via `     (backtick) characters in a print job.
    CVE-2015-8560
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. (CVE-2015-8560)

It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code.
(CVE-2010-5325)

It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code.
(CVE-2010-5325)

It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. (CVE-2015-8327, CVE-2015-8560)

An updated foomatic package that fixes three security issues is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available from the CVE links in the References section.

Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs.

It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code.
(CVE-2010-5325)

It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. (CVE-2015-8327, CVE-2015-8560)

All foomatic users should upgrade to this updated package, which contains backported patches to correct these issues.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-0491 advisory.

    - CVE-2015-8327, CVE-2015-8560

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289850	MiracleLinux 4 : foomatic-4.0.4-5.AXS4 (AXSA:2016-162:01)	Nessus	Miracle Linux Local Security Checks	critical
90632	Amazon Linux AMI : foomatic (ALAS-2016-690)	Nessus	Amazon Linux Local Security Checks	critical
90142	Scientific Linux Security Update : foomatic on SL6.x i386/x86_64 (20160323)	Nessus	Scientific Linux Local Security Checks	critical
90120	CentOS 6 : foomatic (CESA-2016:0491)	Nessus	CentOS Local Security Checks	critical
90114	RHEL 6 : foomatic (RHSA-2016:0491)	Nessus	Red Hat Local Security Checks	critical
90110	Oracle Linux 6 : foomatic (ELSA-2016-0491)	Nessus	Oracle Linux Local Security Checks	critical

Detections

Analytics

CVE-2010-5325

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical