USN-2699-1: HPLIP vulnerability

Ubuntu Security Notice USN-2699-1

30th July, 2015

hplip vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 15.04
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

HPLIP could be tricked into downloading a different GPG key when performing printer plugin installations.

Software description

• hplip - HP Linux Printing and Imaging System (HPLIP)

Details

Enrico Zini discovered that HPLIP used a short GPG key ID when downloading
keys from the keyserver. An attacker could possibly use this to return a
different key with a duplicate short key id and perform a man-in-the-middle
attack on printer plugin installations.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 15.04:

hplip-data 3.15.2-0ubuntu4.2

Ubuntu 14.04 LTS:

hplip-data 3.14.3-0ubuntu3.4

Ubuntu 12.04 LTS:

hplip-data 3.12.2-1ubuntu3.5

To update your system, please follow these instructions: http://ift.tt/17VXqjU.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-0839

from Ubuntu Security Notices http://ift.tt/1SkDwaB