CVE-2020-10001

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory.(CVE-2020-10001)

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: access to uninitialized buffer in ipp.c (CVE-2020-10001)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: access to uninitialized buffer in ipp.c (CVE-2020-10001)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2020-10001: 1927452 cups: access to uninitialized buffer in ipp.c [rhel-8]

The updated cups packages fix security vulnerability: Out-of-bounds read in the ippReadIO function (CVE-2020-10001).

This update for cups fixes the following issues:

• CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
• CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

• CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
• CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).

This update for cups fixes the following issues:

• CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
• CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).

Joshua Mason discovered that CUPS incorrectly handled the secret key used to access the administrative web interface. A remote attacker could possibly use this issue to open a session as an administrator and execute arbitrary code. (CVE-2022-26691)

It was discovered that CUPS incorrectly handled certain memory operations when handling IPP printing. A remote attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-8842, CVE-2020-10001)

USN-5454-1 fixed several vulnerabilities in CUPS. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Joshua Mason discovered that CUPS incorrectly handled the secret key used to access the administrative web interface. A remote attacker could possibly use this issue to open a session as an administrator and execute arbitrary code. (CVE-2022-26691)

It was discovered that CUPS incorrectly handled certain memory operations when handling IPP printing. A remote attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-8842, CVE-2020-10001)