CVE-2023-32324

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function format_log_line could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file cupsd.conf sets the value of loglevel to DEBUG. No known patches or workarounds exist at time of publication.

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function format_log_line could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file cupsd.conf sets the value of loglevel to DEBUG. No known patches or workarounds exist at time of publication.

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function format_log_line could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file cupsd.conf sets the value of loglevel to DEBUG. No known patches or workarounds exist at time of publication.(CVE-2023-32324)

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function format_log_line could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file cupsd.conf sets the value of loglevel to DEBUG. No known patches or workarounds exist at time of publication.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: heap buffer overflow may lead to DoS (CVE-2023-32324)
• cups: use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: heap buffer overflow may lead to DoS (CVE-2023-32324)
• cups: use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: a heap buffer overflow vulnerability
  • debian/patches/CVE-2023-32324.patch: fix _cups_strlcpy() to exit immideately if a length of the source string is zero
  • CVE-2023-32324

• CVE-2023-32360: require authentication for CUPS-Get-Document.
• CVE-2023-32324: fix _cups_strlcpy() to exit immediately if a length of the source string is zero

• CVE-2023-32360: require authentication for CUPS-Get-Document.
• CVE-2023-32324: fix _cups_strlcpy() to exit immediately if a length of the source string is zero

• CVE-2023-32324: Fix heap buffer overflow vulnerability in format_log_line function

A heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function 'format_log_line' could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file 'cupsd.conf' sets the value of loglevel to 'DEBUG'. (CVE-2023-32324)

These are all security issues fixed in the cups-2.4.2-5.1 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

• CVE-2023-32324: Fixed a buffer overflow in format_log_line() which could cause a denial-of-service (bsc#1211643).

This update for cups fixes the following issues:

• CVE-2023-32324: Fixed a buffer overflow in format_log_line() which could cause a denial-of-service (bsc#1211643).

This update for cups fixes the following issues:

• Version upgrade to 2.4.11: See https://github.com/openprinting/cups/releases CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes. Detailed list (from CHANGES.md):

  • Updated the maximum file descriptor limit for cupsd to 64k-1 (Issue #989)
  • Fixed lpoptions -d with a discovered but not added printer (Issue #833)
  • Fixed incorrect error message for HTTP/IPP errors (Issue #893)
  • Fixed JobPrivateAccess and SubscriptionPrivateAccess support for "all" (Issue #990)
  • Fixed issues with cupsGetDestMediaByXxx (Issue #993)
  • Fixed adding and modifying of printers via the web interface (Issue #998)
  • Fixed HTTP PeerCred authentication for domain users (Issue #1001)
  • Fixed checkbox support (Issue #1008)
  • Fixed printer state notifications (Issue #1013)
  • Fixed IPP Everywhere printer setup (Issue #1033) Issues are those at https://github.com/OpenPrinting/cups/issues In particular CUPS 2.4.11 contains those commit regarding IPP response validation and processing PPD values:
  • "Quote PPD localized strings" https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd plus a cleanup to "Fix warnings for unused vars" https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b

• Version upgrade to 2.4.10: See https://github.com/openprinting/cups/releases CUPS 2.4.10 brings two fixes:

  • Fixed error handling when reading a mixed 1setOf attribute.
  • Fixed scheduler start if there is only domain socket to listen on (Issue #985) which is fix for regression after fix for CVE-2024-35235 in scenarios where is no other listeners in cupsd.conf than domain socket created on demand by systemd, launchd or upstart. Issues are those at https://github.com/OpenPrinting/cups/issues

• Version upgrade to 2.4.9: See https://github.com/openprinting/cups/releases CUPS 2.4.9 brings security fix for CVE-2024-35235 and several bug fixes regarding CUPS Web User Interface, PPD generation and HTTP protocol implementation. Detailed list (from CHANGES.md):

  • Fixed domain socket handling (CVE-2024-35235)
  • Fixed creating of cupsUrfSupported PPD keyword (Issue #952)
  • Fixed searching for destinations in web ui (Issue #954)
  • Fixed TLS negotiation using OpenSSL with servers that require the TLS SNI extension.
  • Really raised cups_enum_dests() timeout for listing available IPP printers (Issue #751)...
  • Fixed Host header regression (Issue #967)
  • Fixed DNS-SD lookups of local services with Avahi (Issue #970)
  • Fixed listing jobs in destinations in web ui. (Apple issue #6204)
  • Fixed showing search query in web ui help page. (Issue #977) Issues are those at https://github.com/OpenPrinting/cups/issues Apple issues are those at https://github.com/apple/cups/issues

• Update to version 2.4.8: See https://github.com/openprinting/cups/releases CUPS 2.4.8 brings many bug fixes which aggregated over the last half a year. It brings the important fix for race conditions and errors which can happen when installing permanent IPP Everywhere printer, support for PAM modules password-auth and system-auth and new option for lpstat which can show only the successful jobs. Detailed list (from CHANGES.md):

  • Added warning if the device has to be asked for 'all,media-col-database' separately (Issue #829)
  • Added new value for 'lpstat' option '-W' - successfull - for getting successfully printed jobs (Issue #830)
  • Added support for PAM modules password-auth and system-auth (Issue #892)
  • Updated IPP Everywhere printer creation error reporting (Issue #347)
  • Updated and documented the MIME typing buffering limit (Issue #925)
  • Raised 'cups_enum_dests()' timeout for listing …

It was discovered that CUPS incorrectly handled logging. A remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-6128-1 fixed a vulnerability in CUPS. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that CUPS incorrectly handled logging. A remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.