bugbot adjusting priority

This is CVE-2014-9679, not CVE-2015-9679
               ^                  ^

Created attachment 623543 [details]
testraster.c to reproduce the issue (improved https://www.cups.org/strfiles.php/3428/testraster.c)

To compile it you need cups-devel (and cups-libs) RPMs, then run

# gcc -lcupsimage -o testraster testraster.c


To see the segfault, download
https://www.cups.org/strfiles.php/3429/bogus.raster.gz
and unzip it into "bogus.raster" and then run

# ./testraster <bogus.raster >testraster.out

and you will get something like:
---------------------------------------------------------------------
cupsRasterReadPixels break
*** glibc detected *** ./testraster: munmap_chunk():
 invalid pointer: 0x0000000000602ab0 ***
...
Aborted
---------------------------------------------------------------------

Fixed CUPS for SLE11 is in IBS
project home:jsmeix:branches:SUSE:SLE-11:Update:Test
package cups.SUSE_SLE-11_Update_Test

With that you will get:
----------------------------------------------------------------------------
# ./testraster <bogus.raster >testraster.out
cupsRasterReadHeader failed
----------------------------------------------------------------------------

Maintenance team:

I cannot submit the fixed CUPS for SLE11 in IBS
project home:jsmeix:branches:SUSE:SLE-11:Update:Test
package cups.SUSE_SLE-11_Update_Test

What I did:
----------------------------------------------------------------------------
$ isc branch -M SUSE:SLE-11:Update cups

[fixed via added str4551.CVE-2014-9679.CUPS-1.3.9.patch]

$ isc maintenancerequest home:jsmeix:branches:SUSE:SLE-11:Update:Test \
 cups.SUSE_SLE-11_Update_Test SUSE:SLE-11:Update:Test

Using target project 'SUSE:Maintenance'
Server returned an error: HTTP Error 400: Bad Request
Maintenance incident request contains release target project SUSE:SLE-11:Update:Test with invalid project kind "standard" for package cups.SUSE_SLE-11_Update_Test

$ rpm -q osc
osc-0.150.1-157.1
----------------------------------------------------------------------------

Fixed CUPS for SLE12 is in IBS
project home:jsmeix:branches:SUSE:SLE-12:Update
package cups.SUSE_SLE-12_Update
and submitted it:
-----------------------------------------------------------------------------
$ isc maintenancerequest home:jsmeix:branches:SUSE:SLE-12:Update \
 cups.SUSE_SLE-12_Update SUSE:SLE-12:Update
Using target project 'SUSE:Maintenance'
51720
-----------------------------------------------------------------------------

Fixed CUPS for openSUSE 13.2 in OBS
project home:jsmeix:branches:openSUSE:13.2:Update
source package cups.openSUSE_13.2_Update
and submitted it:
-----------------------------------------------------------------------------
$ osc maintenancerequest home:jsmeix:branches:openSUSE:13.2:Update \
 cups.openSUSE_13.2_Update openSUSE:13.2:Update
Using target project 'openSUSE:Maintenance'
286514
-----------------------------------------------------------------------------

Fixed CUPS for openSUSE 13.1 in OBS
project home:jsmeix:branches:openSUSE:13.1:Update
source package cups.openSUSE_13.1_Update
and submitted it:
-----------------------------------------------------------------------------
$ osc maintenancerequest home:jsmeix:branches:openSUSE:13.1:Update \
 cups.openSUSE_13.1_Update openSUSE:13.1:Update
Using target project 'openSUSE:Maintenance'
286515
-----------------------------------------------------------------------------

This is an autogenerated message for OBS integration:
This bug (917799) was mentioned in
https://build.opensuse.org/request/show/286514 13.2 / cups
https://build.opensuse.org/request/show/286515 13.1 / cups

maint-coord@suse.de see
https://bugzilla.opensuse.org/show_bug.cgi?id=917799#c5

just reassign security bugs back to security-team

Ah , for comment #c5

do not use mbranch or maintenancerequest for SLES 11.

cd home:jsmeix:branches:SUSE:SLE-11:Update:Test/cups.SUSE_SLE-11_Update_Test SUSE:SLE-11:Update:Test

osci sr SUSE:SLE-11:Update:Test cups

Marcus,
many thanks for the information!
The server's returned error message mislead me.
I thought there is some issue in the build service.

Now I submitted the fixed CUPS for SLE11 in IBS
project home:jsmeix:branches:SUSE:SLE-11:Update:Test
source package cups.SUSE_SLE-11_Update_Test
to SUSE:SLE-11:Update:Test/cups
via IBS submitrequest 51768

An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-03-04.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/60708

Thank you for the submits. Can you please check if SLE 10 SP3 is vulnerable?

Of course I check if SLE10 is vulnerable
but the filter/raster.c soucre is there somewhat different
so that I need a bit more time for SLE10.

At least CUPS in SLE10-SP3 is not in the same way vulnerable
because there is no crash:
------------------------------------------------------------------------
# ./testraster <bogus.raster.gz >testraster.out
cupsRasterOpen failed
------------------------------------------------------------------------

Or is it already a sufficient check that SLE10-SP3 is not vulnerable
when it does not crash with CUPS in SLE10-SP3?

Created attachment 623671 [details]
modified testraster.c to reproduce the issue on SLE10

CUPS on SLE10 does not provide cups_page_header2_t or cupsRasterReadHeader2
so that for SLE10 a modified testraster.c is needed:
----------------------------------------------------------------------------
--- testraster.c   2015-02-17 13:56:00.000000000 +0100
+++ testraster.sle10.c     2015-02-18 12:22:12.000000000 +0100
@@ -6,7 +6,7 @@
 int main()
 {
   cups_raster_t *raster;
-  cups_page_header2_t header;
+  cups_page_header_t header;
   unsigned char *buf;
   unsigned line, r;
 
@@ -16,7 +16,7 @@ int main()
     return 1;
   }
 
-  r = cupsRasterReadHeader2(raster, &header);
+  r = cupsRasterReadHeader(raster, &header);
   if (!r)
   { fprintf ( stderr, "cupsRasterReadHeader failed\n" );
     return 1;
----------------------------------------------------------------------------

Fixed CUPS 1.5.4 for the SLE12 "legacy" module in IBS
project home:jsmeix:branches:SUSE:SLE-12:Update
package cups154.SUSE_SLE-12_Update
and submitted it:
-----------------------------------------------------------------------------
$ isc maintenancerequest home:jsmeix:branches:SUSE:SLE-12:Update \
 cups154.SUSE_SLE-12_Update SUSE:SLE-12:Update
Using target project 'SUSE:Maintenance'
52050
-----------------------------------------------------------------------------

(In reply to Johannes Meixner from comment #16)
As discussed this is sufficient. SLE 10 doesn't need the fix. So we take this from here on. Thank you for the submits.

openSUSE-SU-2015:0381-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 917799
CVE References: CVE-2014-9679
Sources used:
openSUSE 13.2 (src):    cups-1.5.4-21.6.1
openSUSE 13.1 (src):    cups-1.5.4-12.17.1

SUSE-SU-2015:0465-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 917799
CVE References: CVE-2014-9679
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    cups-1.7.5-5.1
SUSE Linux Enterprise Server 12 (src):    cups-1.7.5-5.1
SUSE Linux Enterprise Module for Legacy Software 12 (src):    cups154-1.5.4-5.1
SUSE Linux Enterprise Desktop 12 (src):    cups-1.7.5-5.1
SUSE Linux Enterprise Build System Kit 12 (src):    cups-1.7.5-5.1

SUSE-SU-2015:0465-2: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 917799
CVE References: CVE-2014-9679
Sources used:
SUSE Linux Enterprise Build System Kit 12 (src):    cups-1.7.5-5.1

released

SUSE-SU-2015:0575-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 917799
CVE References: CVE-2014-9679
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    cups-1.3.9-8.46.54.2
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    cups-1.3.9-8.46.54.2
SUSE Linux Enterprise Server 11 SP3 (src):    cups-1.3.9-8.46.54.2
SUSE Linux Enterprise Desktop 11 SP3 (src):    cups-1.3.9-8.46.54.2