-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  cups (SSA:2007-305-01)

CUPS was found to contain errors in ipp.c which could allow a remote attacker
to crash CUPS, resulting in a denial of service.  If you use CUPS, it is
recommended to update to the latest package for your version of Slackware.

The latest cups package is available for Slackware -current, and patched
packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 
and 12.0 that fix the problems.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4351


Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/cups-1.2.11-i486-2_slack12.0.tgz:
  Patched cups-1.2.11.
  An off-by-one error in ipp.c may allow a remote attacker to crash CUPS
  resulting in a denial of service.
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4351
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
directly from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org/) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://www.slackware.com/ for
additional mirror sites near you.

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/cups-1.1.19-i386-2_slack8.1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/cups-1.1.19-i386-2_slack9.0.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/cups-1.1.21-i486-2_slack9.1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/cups-1.1.21-i486-2_slack10.0.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/cups-1.1.23-i486-2_slack10.1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/cups-1.1.23-i486-2_slack10.2.tgz

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/cups-1.1.23-i486-5_slack11.0.tgz

Updated package for Slackware 12.0:

Updated package for Slackware -current:


MD5 signatures:
+-------------+

Slackware 8.1 package:
f6a62aa21fca9e0209b0fcb5ec577b9e  cups-1.1.19-i386-2_slack8.1.tgz

Slackware 9.0 package:
6885ff8137f28cb158813f5f6d3717bc  cups-1.1.19-i386-2_slack9.0.tgz

Slackware 9.1 package:
105d3e46bd6370c2e284f4742e6396bf  cups-1.1.21-i486-2_slack9.1.tgz

Slackware 10.0 package:
c3dee12331e2cd3f26cc13a335d9a220  cups-1.1.21-i486-2_slack10.0.tgz

Slackware 10.1 package:
82a16ce6427f0019a28176053740155e  cups-1.1.23-i486-2_slack10.1.tgz

Slackware 10.2 package:
e1c131bdae63d28664688f3876d4e2dd  cups-1.1.23-i486-2_slack10.2.tgz

Slackware 11.0 package:
7cfdebc0aedc821e7d83e593d7cb7d9c  cups-1.1.23-i486-5_slack11.0.tgz

Slackware 12.0 package:
7fc3c9fc2aa5b9dbfe519f2483516528  cups-1.2.11-i486-2_slack12.0.tgz

Slackware -current package:
811176fc91d13cd3b811b9c0b303cdb0  cups-1.3.3-i486-1.tgz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg cups-1.2.11-i486-2_slack12.0.tgz

Then, restart cups:
sh /etc/rc.d/rc.cups restart


+-----+