Bug 201134 - [MAINTAINER] print/cups-filters: update to 1.0.70
Summary: [MAINTAINER] print/cups-filters: update to 1.0.70
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Dmitry Marakasov
Keywords: patch, patch-ready, security
Depends on:
Reported: 2015-06-26 21:17 UTC by Naram Qashat
Modified: 2015-07-07 05:59 UTC (History)
2 users (show)

See Also:

cups-filters-1.0.70.patch (784 bytes, patch)
2015-06-26 21:17 UTC, Naram Qashat
no flags Details | Diff
Poudriere log (88.28 KB, text/plain)
2015-06-26 21:17 UTC, Naram Qashat
no flags Details
security/vuxml entry for cups-filters CVE-2015-3258 (1.96 KB, patch)
2015-06-29 02:20 UTC, Jason Unovitch
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Naram Qashat 2015-06-26 21:17:07 UTC
Created attachment 158082 [details]

Update to 1.0.70.
Comment 1 Naram Qashat 2015-06-26 21:17:25 UTC
Created attachment 158083 [details]
Poudriere log
Comment 2 Jason Unovitch freebsd_committer 2015-06-29 02:20:31 UTC
Created attachment 158143 [details]
security/vuxml entry for cups-filters CVE-2015-3258

- Add vuxml entry to supplement this maintainer update.

Thanks for the submission.  I added ports-secteam to CC given this was reported on oss-security as a security issue.

Document CVE-2015-3258 reported here:

Supplement the entry with verbiage from the cups-filter upstream change log.

==== Validation
env PKG_DBDIR=/usr/ports/security/vuxml pkg audit cups-filters-1.0.69
cups-filters-1.0.69 is vulnerable:
cups-filters -- buffer overflow in texttopdf size allocation
CVE: CVE-2015-3258
WWW: https://vuxml.FreeBSD.org/freebsd/b19da422-1e02-11e5-b43d-002590263bf5.html

1 problem(s) in the installed packages found.

# env PKG_DBDIR=/usr/ports/security/vuxml pkg audit cups-filters-1.0.70
0 problem(s) in the installed packages found.

# make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml
>>> Successful.
Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml
Comment 3 Jason Unovitch freebsd_committer 2015-06-29 04:13:07 UTC
(In reply to Naram Qashat from comment #1)

Supplementing the 9.3-PRERELEASE Poudriere log attached, I have built on all currently supported releases along with CURRENT as shown by the trimmed output from my `poudriere jail -l` below.  No Poudriere related QA issues were reported.

8.4-RELEASE-p31      amd64
8.4-RELEASE-p31      i386
9.3-RELEASE-p17      amd64
9.3-RELEASE-p17      i386
10.1-RELEASE-p13     amd64
10.1-RELEASE-p13     i386
11.0-CURRENT r284725 amd64
11.0-CURRENT r284725 i386
Comment 4 commit-hook freebsd_committer 2015-06-30 21:48:51 UTC
A commit references this bug:

Author: amdmi3
Date: Tue Jun 30 21:47:58 UTC 2015
New revision: 391010
URL: https://svnweb.freebsd.org/changeset/ports/391010

  - Update to 1.0.70

  PR:		201134
  Submitted by:	cyberbotx@cyberbotx.com (maintainer)
  Differential Revision:

Comment 5 Jason Unovitch freebsd_committer 2015-06-30 23:28:13 UTC
Dmitry, Can the attached CVE-2015-3258 vuxml entry be committed before we really call this one closed?  Thanks.
Comment 6 Dmitry Marakasov freebsd_committer 2015-06-30 23:57:05 UTC
Oops, missed that, sorry.
Comment 7 commit-hook freebsd_committer 2015-06-30 23:57:08 UTC
A commit references this bug:

Author: amdmi3
Date: Tue Jun 30 23:56:41 UTC 2015
New revision: 391016
URL: https://svnweb.freebsd.org/changeset/ports/391016

  - Document CVE-2015-3258 (cups-filters buffer overflow vulnerability)

  PR:		201134
  Submitted by:	cyberbotx@cyberbotx.com
  Differential Revision:

Comment 8 Kubilay Kocak freebsd_committer freebsd_triage 2015-07-07 05:59:43 UTC
Classify correctly after resolution