• Login
• cups.org
• Articles
• Bugs
• Documentation
• Download
• Drivers
• Links
• Lists

CUPS v1.1.6-2 Source Update Now Available!

Created at 09:00 Feb 07, 2001 by mike, last modified at 16:00 Dec 31, 1969

An updated source distribution for CUPS is now available that fixes some distribution problems.  The new distribution also includes several security fixes:

        

• Added changes to support NetBSD startup scripts.

          

• Added separate compiler options for pstoraster
          (Ghostscript) to avoid compiler-induced errors
          from Ghostscript's twisted code.

          

• The mime.types file contained syntax errors.

          

• Updated the *BSD USB device filenames to use
          the /dev/unlptN files so that the USB device
          is not reset prior to printing (causes print
          corruption on many printers)

          

• Added new cupsTempFd() function to avoid serious
          security bug in glibc fopen() function.  The glibc
          fopen() function unlinks a file before creating it,
          which opens up possible symlink attacks.

          [Editor's note: this appears only to affect a beta
           release of glibc, not any current production release]

          

• Now reject 0-length names in add-printer and add-class
          requests.

          

• Fix for pstoraster when ZLIB is not available.

          

• cupsGetPPD() didn't reconnect when a HTTP connection
          was lost.

          

• SuSE fix: httpConnect() didn't check that the
          value from gethostbyname() was a valid IPv4 address.

          

• SuSE fix: httpConnect() didn't allow file descriptor 0
          to be used for a socket.

          

• SuSE fix: ippRead() didn't confirm that all values in
          a set were numeric or string types.

          

• SuSE fix: lppasswd race condition fixes.

          

• SuSE fix: directive names could overflow buffer when
          reading *.conf files.

          

• SuSE fix: HEAD requests for PPD files did not use the
          same logic as GET requests.

          

• SuSE fix: possible buffer overflow when adding
          /index.html to requested directory name.

          

• SuSE fix: possible buffer overflow when converting
          IPP attributes to string options for filters.

          

• SuSE fix: creating file: device output with mode 0666
          instead of mode 0600.

          

• SuSE fix: creating job info files with mode 0640
          instead of 0600.

          

• SuSE fix: don't rely on snprintf() for including
          system name in log filenames.

          

• SuSE fix: add bounds checking when copying quoted
          and hex strings.

Comments