[USN-1981-1] HPLIP vulnerabilities

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJSSchDAAoJEGVp2FWnRL6TNa0P/j7BOOkHNIHlQOeXnovqCveq
jOpcvUVsmxKD0MlgRPbUbSih9wlG3gRuZ9tgOhAWrh3zJHrB5sXn7u2ra90n4paY
NaF+dnNXGhDcvMSj/I5Y1Iu0Aqnf5LIK7+80jOXt2hKe7lygKvmsAcQZ8ogN0IYr
6UOSzWrsA6lGwyUxKG/boMlVto/u+tzfDSJGWdqIzj2PmUy16dxtJ5VaQX8biqLJ
lg9eRCzSeA4xqrWu8zRJLENDamwBD/HMWW97RVPkze9af/6uUxCQQzgbsxT6mUif
BMqxUeXVRh+Uxg9c/Dc13YuEbMxElvTnhHNr172lzftXYi0uIePTW+66sFZDS9P1
QLVwa2lQb+8QUEpvX+gedxTPC/mF2ssiagm5HwpXY6zmZW8X7mJKiVeQ+b4iMzrw
cvEblQ8VyWdkYA4iP0cwRAVtDDMjN8LlXwMtlLe+AEn6LxH4f7BfFlQzlwLYPdQY
UDZ9n1LoZK/QZmvwgEv3/fmLUsbh3hU4BTtiIJwgVUl4KrVCxYgcj3jPpHTQ4sTI
cWbU476SNmYi+Wa+aaWXte3505Uy/bn4h9xk7Obopn0omvDfYMv6QknKUxTTopCo
Rn45Fc/sNe2uLScglEg7xAZwTw4fJ10upzgG+38yL89tzAKemgOBpG7D4KIin68J
cBHrs71/sWOpNDYkykAK
=To6a
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-1981-1
September 30, 2013

hplip vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

HPLIP could be made to overwrite files.

Software Description:
- hplip: HP Linux Printing and Imaging System (HPLIP)

Details:

It was discovered that HPLIP incorrectly handled temporary files when using
the fax capabilities. A local attacker could possibly use this issue to
overwrite arbitrary files. This issue only applied to Ubuntu 10.04 LTS.
(CVE-2011-2722)

Tim Waugh discovered that HPLIP incorrectly handled temporary files when
printing. A local attacker could possibly use this issue to overwrite
arbitrary files. In the default installation of Ubuntu 12.04 LTS and Ubuntu
12.10, this should be prevented by the Yama link restrictions.
(CVE-2013-0200)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
hplip 3.12.6-3ubuntu4.2

Ubuntu 12.04 LTS:
hplip 3.12.2-1ubuntu3.3

Ubuntu 10.04 LTS:
hplip 3.10.2-2ubuntu2.4

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1981-1
CVE-2011-2722, CVE-2013-0200

Package Information:
https://launchpad.net/ubuntu/+source/hplip/3.12.6-3ubuntu4.2
https://launchpad.net/ubuntu/+source/hplip/3.12.2-1ubuntu3.3
https://launchpad.net/ubuntu/+source/hplip/3.10.2-2ubuntu2.4