Security update for cups SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0604-1 Final 1 1 2018-03-05T09:43:11Z current 2018-03-05T09:43:11Z 2018-03-05T09:43:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cups This update for cups fixes the following issues: - CVE-2017-18190: Removed localhost.localdomain from list of trustworthy hosts in scheduler/client.c to avoid arbitrary IPP command execution in conjunction with DNS rebinding. (bsc#1081557) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2018-410,SUSE-SLE-DESKTOP-12-SP2-2018-410,SUSE-SLE-DESKTOP-12-SP3-2018-410,SUSE-SLE-RPI-12-SP2-2018-410,SUSE-SLE-SAP-12-SP1-2018-410,SUSE-SLE-SDK-12-SP2-2018-410,SUSE-SLE-SDK-12-SP3-2018-410,SUSE-SLE-SERVER-12-2018-410,SUSE-SLE-SERVER-12-SP1-2018-410,SUSE-SLE-SERVER-12-SP2-2018-410,SUSE-SLE-SERVER-12-SP3-2018-410 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180604-1/ Link for SUSE-SU-2018:0604-1 https://lists.opensuse.org/opensuse-security-announce/2018-03/msg00023.html E-Mail link for SUSE-SU-2018:0604-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1081557 SUSE Bug 1081557 https://www.suse.com/security/cve/CVE-2017-18190/ SUSE CVE CVE-2017-18190 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE OpenStack Cloud 6 cups-1.7.5-20.3.1 cups-client-1.7.5-20.3.1 cups-libs-1.7.5-20.3.1 cups-libs-32bit-1.7.5-20.3.1 cups-ddk-1.7.5-20.3.1 cups-devel-1.7.5-20.3.1 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP2 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP2 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP2 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP2 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP3 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP3 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP3 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12 SP3 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 cups-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 cups-client-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 cups-libs-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 cups-ddk-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 cups-devel-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 cups-ddk-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 cups-devel-1.7.5-20.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 cups-1.7.5-20.3.1 as a component of SUSE OpenStack Cloud 6 cups-client-1.7.5-20.3.1 as a component of SUSE OpenStack Cloud 6 cups-libs-1.7.5-20.3.1 as a component of SUSE OpenStack Cloud 6 cups-libs-32bit-1.7.5-20.3.1 as a component of SUSE OpenStack Cloud 6 A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1). CVE-2017-18190 SUSE Linux Enterprise Desktop 12 SP2:cups-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP2:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP2:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP2:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP3:cups-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP3:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP3:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Desktop 12 SP3:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP1-LTSS:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP1-LTSS:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP1-LTSS:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP1-LTSS:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP2:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP2:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP2:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP2:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP3:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP3:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP3:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server 12 SP3:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server 12-LTSS:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server 12-LTSS:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server 12-LTSS:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server 12-LTSS:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:cups-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:cups-client-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:cups-libs-1.7.5-20.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:cups-libs-32bit-1.7.5-20.3.1 SUSE Linux Enterprise Software Development Kit 12 SP2:cups-ddk-1.7.5-20.3.1 SUSE Linux Enterprise Software Development Kit 12 SP2:cups-devel-1.7.5-20.3.1 SUSE Linux Enterprise Software Development Kit 12 SP3:cups-ddk-1.7.5-20.3.1 SUSE Linux Enterprise Software Development Kit 12 SP3:cups-devel-1.7.5-20.3.1 SUSE OpenStack Cloud 6:cups-1.7.5-20.3.1 SUSE OpenStack Cloud 6:cups-client-1.7.5-20.3.1 SUSE OpenStack Cloud 6:cups-libs-1.7.5-20.3.1 SUSE OpenStack Cloud 6:cups-libs-32bit-1.7.5-20.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180604-1/ https://www.suse.com/security/cve/CVE-2017-18190.html CVE-2017-18190 https://bugzilla.suse.com/1081557 SUSE Bug 1081557