==========================================================================
Ubuntu Security Notice USN-2699-1
July 30, 2015

hplip vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 15.04
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS

Summary:

HPLIP could be tricked into downloading a different GPG key when
performing printer plugin installations.

Software Description:
– hplip: HP Linux Printing and Imaging System (HPLIP)

Details:

Enrico Zini discovered that HPLIP used a short GPG key ID when downloading
keys from the keyserver. An attacker could possibly use this to return a
different key with a duplicate short key id and perform a man-in-the-middle
attack on printer plugin installations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
hplip-data 3.15.2-0ubuntu4.2

Ubuntu 14.04 LTS:
hplip-data 3.14.3-0ubuntu3.4

Ubuntu 12.04 LTS:
hplip-data 3.12.2-1ubuntu3.5

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2699-1
CVE-2015-0839

Package Information:
https://launchpad.net/ubuntu/+source/hplip/3.15.2-0ubuntu4.2
https://launchpad.net/ubuntu/+source/hplip/3.14.3-0ubuntu3.4
https://launchpad.net/ubuntu/+source/hplip/3.12.2-1ubuntu3.5

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJVulxFAAoJEGVp2FWnRL6T/AMQAJrD8+jTet1q0jKNm5FHjY2Y
K390oG90rmwIhq+Usg0TvRm0wqPLDnBbKOAMJRI4GDY+xEfLMqaJqyxln+awWS7P
946N8z/YAzpHeNLkuyD/YQOHFvnnmO6Y/ZolGgEuz30Bouuq8ICBtz5awADjj/Yg
GPqBtj1JGZLpw8GP5EjOQ0qXeiv4tbbFWmTGnlK5VknIo3+SH1BQp7bu20hJ2h6c
cXk6pFK1CkfBylPw5L5E5W06kF4nJgpR5zeGO8qIF6n4usifjYlu92akqvuXpS/f
Iiss8aQ49c1DPm4bfC0mTykpw301T0bDy7+WsuA0IS0RPtI8ov2sGcbjno3mHr1L
iMjvUX8bhrIfo2GYc5DA8FIkmyDlmRZPXhW5+GlJ/t38vnG6hEgHun8ztosrWAiH
iLvvRlT4I17wOWhpr5HGeMF86a+BADI4V+VGd0oo05ZCmBVU/JfMxPAVJ+LlvxmM
T4UDPiUiXSLoW1eDX2vhGAny5JN6YfrZcz1zwBHgUXEZvafnuutD5dLMM5Fqfqw6
H2mQwkMlXSkm0fn3n76x8qPXBtT6euuz3uFUCfjvEZf6XuI0UCyZmOUxPdo+Zylm
JD55iHFB8jBvRmS8fmBuAz+FeVE4wS9w44Ergd6I3NYkVp1ORW6Qore3l100hkEs
tZoUMiOkGNxZv4HWgken
=V2vE
—–END PGP SIGNATURE—–
—