[PLDSA 18-1] New html2ps packages fix arbitrary code execution

[Krzysiek Taraszka]

- --------------------------------------------------------------------------
PLD Security Advisory PLDSA 18-1                        security at pld.org.pl
http://www.pld.org.pl/security/                          PLD Security Team
14 January 2003 			http://www.pld.org.pl/security/faq
- --------------------------------------------------------------------------

Package        : prior to html2ps-1.0b3-3		
Vulnerability  : arbitrary code execution
Problem-Type   : local
PLD-specific   : no

The SuSE Security Team found a vulnerability in html2ps, a HTML to
PostScript converter, that opened files based on unsanitized input
insecurely.  This problem can be exploited when html2ps is
installed as filter within lrpng and the attacker has previously
gained access to the lp account.

The above problems have been fixed in version 1.0b3-4 for the
current stable distribution (ra).

We recommend that you upgrade your html2ps packages.

wget -c url
	will fetch the file for you
rpm -Uhv file(s)*.rpm
        will upgrade the referenced file.

If you are using "poldek" - the package manager, use the line as given below
for upgrade packages

poldek --update
        will update the internal database
poldek --upgrade 'html2ps*'
        will install corrected packages

If you are using "apt" - the package manager, use the line as given below
for upgrade packages

apt-get update
        will update the internal database
apt-get upgrade 'html2ps*'
        will install corrected packages

PLD Linux 1.0 alias ra
- --------------------

  Source archives:

ftp://ftp.pld.org.pl/dists/ra/updates/security/SRPMS/html2ps-1.0b3-4.src.rpm
       MD5 checksum: 08794ed538fc045718d42302b2de8746

  I386 Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/html2ps-1.0b3-4.i386.rpm
       MD5 checksum: 8beb5a37333eb68a184e1fe9d8824c57

ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/xhtml2ps-1.0b3-4.i386.rpm
       MD5 checksum: b8e069e16e7d03146a8fc1101e80d4f4


  I586 Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/html2ps-1.0b3-4.i586.rpm
       MD5 checksum: af23485670cd2f1cd799bf54dc8afdab

ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/xhtml2ps-1.0b3-4.i586.rpm
       MD5 checksum: 4ce92b281efbbc03e44ee056a1f2163f


  I686 Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/html2ps-1.0b3-4.i686.rpm
       MD5 checksum: ef105d984f31640c91991aa76026ad55

ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/xhtml2ps-1.0b3-4.i686.rpm
       MD5 checksum: 29eece0d55eb5bbe31d0a097c71fa816


  PowerPC Architecture components:

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/html2ps-1.0b3-4.ppc.rpm
       MD5 checksum: faf72742d287531fb1b5e9e361b47f15

ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/xhtml2ps-1.0b3-4.ppc.rpm
       MD5 checksum: b48e8644b5de30502b8d39fc36c51167


-
--------------------------------------------------------------------------------
-
If you are using poldek add this line to poldek.conf.
If you are using apt-get add this line to sources.list.

For i386 architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/i386/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/i386 base updates-security
For i586 architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/i586/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/i586 base updates-security
For i686 architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/i686/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/i686 base updates-security
For ppc architecture
poldek:         source = ra-updates-security ftp://ftp.pld.org.pl/dists/ra/updates/security/ppc/
apt-get:        rpm ftp://ftp.pld.org.pl/dists ra/apt/ppc base updates-security