CVE-2019-8842

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs.

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs.(CVE-2019-8842)

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs.

Updated cups packages fix security vulnerabilities:

It was discovered that CUPS incorrectly handled certain language values. A local attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or possibly obtain sensitive information (CVE-2019-2228).

Stephan Zeisberg discovered that the CUPS SNMP backend incorrectly handled encoded ASN.1 inputs. A remote attacker could possibly use this issue to cause CUPS to crash by providing specially crafted network traffic (CVE-2019-8675, CVE-2019-8696).

The ippReadIO function may under-read an extension (CVE-2019-8842).

Stephan Zeisberg discovered that CUPS incorrectly handled certain malformed ppd files. A local attacker could possibly use this issue to execute arbitrary code (CVE-2020-3898).

The cups package has been updated to version 2.2.13 and patched to fix these issues and other bugs.

Also, this update will hopefully fix the cups service failing to start at boot on some systems.

This update for cups fixes the following issues:

• CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
• CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

• CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
• CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).

This update for cups fixes the following issues:

• CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
• CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).

Joshua Mason discovered that CUPS incorrectly handled the secret key used to access the administrative web interface. A remote attacker could possibly use this issue to open a session as an administrator and execute arbitrary code. (CVE-2022-26691)

It was discovered that CUPS incorrectly handled certain memory operations when handling IPP printing. A remote attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-8842, CVE-2020-10001)

USN-5454-1 fixed several vulnerabilities in CUPS. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Joshua Mason discovered that CUPS incorrectly handled the secret key used to access the administrative web interface. A remote attacker could possibly use this issue to open a session as an administrator and execute arbitrary code. (CVE-2022-26691)

It was discovered that CUPS incorrectly handled certain memory operations when handling IPP printing. A remote attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-8842, CVE-2020-10001)