Moderate: cups security and bug fix update
Summary
ALSA-2023:7165: Moderate: cups security and bug fix update. Affects cups versions < 1:2.2.6-54.el8_9. Fixed in 1:2.2.6-54.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Common UNIX Printing System (CUPS) is a portable printing layer for Linux, UNIX, and similar operating systems. It provides a framework for managing print jobs, printer queues, and printer drivers. CUPS is widely used in various Linux distributions and is an essential component for printing functionality.
Vulnerability Detail
This security update addresses two vulnerabilities in CUPS:
-
CVE-2023-32324: A heap buffer overflow vulnerability that could be exploited to cause a denial of service (DoS) attack. An attacker could craft a malicious print job that triggers the overflow, leading to a crash or potential code execution.
-
CVE-2023-34241: A use-after-free vulnerability in the cupsdAcceptClient() function in scheduler/client.c. This flaw could be exploited by an attacker to execute arbitrary code or cause a crash by sending specially crafted requests to the CUPS server.
These vulnerabilities pose a moderate risk and could potentially be exploited by remote attackers to disrupt printing services or execute arbitrary code on affected systems.
How To Fix
Minimum fixed version
1:2.2.6-54.el8_9
This is the first release that contains the fix.
sudo dnf update cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This security update addresses two vulnerabilities in CUPS that could be exploited by remote attackers to disrupt printing services or execute arbitrary code. It is recommended to update the affected packages to the latest version as soon as possible. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cups →
FAQ
CUPS (Common UNIX Printing System) is a printing framework used in Linux, UNIX, and similar operating systems. It provides a portable printing layer and manages print jobs, printer queues, and printer drivers.
The heap buffer overflow vulnerability (CVE-2023-32324) can lead to a denial of service (DoS) attack, potentially crashing the CUPS service or allowing code execution. The use-after-free vulnerability (CVE-2023-34241) can be exploited to execute arbitrary code or cause a crash by sending specially crafted requests to the CUPS server.
Users of CUPS on AlmaLinux 8 are affected by these vulnerabilities. Other Linux distributions using CUPS may also be affected if they are running vulnerable versions of the software.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the affected packages to the latest version as soon as possible.
You can find more information about these vulnerabilities, including the impact, CVSS scores, and acknowledgments, on the respective CVE pages: CVE-2023-32324 and CVE-2023-34241.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
