openembedded-core.git/meta/recipes-extended/cups, branch danny

cups CVE-2011-3170

2013-01-07T11:31:48+00:00

the patch come from:
http://cups.org/strfiles/3914/str3914.patch

The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3170

[YOCTO #3583]
[ CQID: WIND00299594 ]
Upstream-Status: Backport

(From OE-Core rev: c82517bb667484854eaa05b6e9efd9ee0f164fec)

Signed-off-by: Li Wang 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

cups - CVE-2011-2896

2013-01-07T11:31:41+00:00

the patch come from:
http://cups.org/strfiles/3867/str3867.patch

The LZW decompressor in the LWZReadByte function in giftoppm.c
in the David Koblas GIF decoder in PBMPLUS, as used in the
gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7,
the LZWReadByte function in plug-ins/common/file-gif-load.c
in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c
in XPCE in SWI-Prolog 5.10.4 and earlier, and other products,
does not properly handle code words that are absent from the
decompression table when encountered, which allows remote attackers to
trigger an infinite loop or a heap-based buffer overflow, and possibly
execute arbitrary code, via a crafted compressed stream, a related
issue to CVE-2006-1168 and CVE-2011-2895.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2896

[YOCTO #3582]
[ CQID: WIND00299595 ]
Upstream-Status: Backport

(From OE-Core rev: 0742b7aecaada435f90f39f26914906a5eb1fd4f)

Signed-off-by: Li Wang 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

cups: CVE-2012-5519

2013-01-07T11:31:34+00:00

lpadmin to (limited) root privilege escalation
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5519
http://www.cups.org/strfiles/4223/str4223v2-1.4.4-debian.patch

[YOCTO #3579]
[ CQID: WIND00392016 ]
Upstream-Status: Backport

(From OE-Core rev: 9f6964b489ef3e0f175bf33a94ab819408875da8)

Signed-off-by: Li Wang 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

cups: disable pdftops

2012-08-23T10:15:51+00:00

This ensure a reliable built without host contamination, this
will also disable the usage of ghostscript.

[YOCTO #2966]

Signed-off-by: Saul Wold

cups_1.4.6.bb: Fix build on ppc64

2012-07-26T13:39:48+00:00

ppc64 uses lib64 and usr/lib64 for library paths
so we need to train cups build system

Signed-off-by: Khem Raj 
Signed-off-by: Saul Wold

Convert tab indentation in python functions into four-space

2012-07-19T09:17:30+00:00

Signed-off-by: Richard Purdie

cups: clean up FILE after PACKAGE reorder

2012-06-20T04:59:52+00:00

Signed-off-by: Saul Wold

meta: replace os.system with subprocess.call

2012-05-30T09:56:15+00:00

Replace os.system with subprocess.call since the older function would
fail (more or less) silently if the executed program cannot be found

More info:
http://docs.python.org/library/subprocess.html#subprocess-replacements

[YOCTO #2454]

Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

cups: Ensure cups-config has correct target paths, not sysroot ones for cups_serverbin and cups_datadir variables

2012-03-16T16:46:28+00:00

These are used by dependent packages to know where to install cups related
pieces into therefore we need to remove the sysroot prefix from these.

Signed-off-by: Richard Purdie

meta: Convert getVar/getVarFlag(xxx, 1) -> (xxx, True)

2012-03-05T18:33:18+00:00

Using "1" with getVar is bad coding style and "True" is preferred.
This patch is a sed over the meta directory of the form:

sed \
 -e 's:\(\.getVar([^,()]*, \)1 *):\1True):g' \
 -e 's:\(\.getVarFlag([^,()]*, [^,()]*, \)1 *):\1True):g' \
 -i `grep -ril getVar *`

Signed-off-by: Richard Purdie