Synopsis:	Moderate: cups security update
Issue date:	2009-11-18
CVE Names:	CVE-2009-2820 CVE-2009-3553

A use-after-free flaw was found in the way CUPS handled references in 
its file descriptors-handling interface. A remote attacker could, in a
specially-crafted way, query for the list of current print jobs for a
specific printer, leading to a denial of service (cupsd crash).
(CVE-2009-3553)

Several cross-site scripting (XSS) flaws were found in the way the CUPS 
web server interface processed HTML form content. If a remote attacker 
could trick a local user who is logged into the CUPS web interface into 
visiting a specially-crafted HTML page, the attacker could retrieve and 
potentially modify confidential CUPS administration data. (CVE-2009-2820)

After installing the update, the cupsd daemon will be restarted 
automatically.

NOTE: SL 5.0, 5.1 and 5.2 users.  Be sure to update rpm before doing 
this update.  You should just need to do a "yum update rpm\*"
These cups pacakges use API's found in the newer version of rpm, that 
came with SL 5.3 and above.  If you do not update rpm, then this cups 
update might stall and possibly never finish.

SL 5.x

     SRPMS:
cups-1.3.7-11.el5_4.4.src.rpm
     i386:
cups-1.3.7-11.el5_4.4.i386.rpm
cups-devel-1.3.7-11.el5_4.4.i386.rpm
cups-libs-1.3.7-11.el5_4.4.i386.rpm
cups-lpd-1.3.7-11.el5_4.4.i386.rpm
     x86_64:
cups-1.3.7-11.el5_4.4.x86_64.rpm
cups-devel-1.3.7-11.el5_4.4.i386.rpm
cups-devel-1.3.7-11.el5_4.4.x86_64.rpm
cups-libs-1.3.7-11.el5_4.4.i386.rpm
cups-libs-1.3.7-11.el5_4.4.x86_64.rpm
cups-lpd-1.3.7-11.el5_4.4.x86_64.rpm

-Connie Sieh
-Troy Dawson