CVE-2023-4504

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers..

Security Fix(es):

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

• SECURITY UPDATE: heap-based buffer overflow
  • debian/patches/CVE-2023-4504.patch: check for end of buffer if there is an escaped character
  • CVE-2023-4504

• SECURITY UPDATE: heap-based buffer overflow
  • debian/patches/CVE-2023-4504.patch: check for end of buffer if there is an escaped character
  • CVE-2023-4504

• CVE-2023-4504: scan_ps(): check for null terminator after backslash character

• CVE-2023-4504: check for null terminator after a backslash

• CVE-2023-4504: check for null terminator after a backslash

• CVE-2023-4504: validate length of attacker-crafted PPD PostScript documents to prevent heap-based buffer overflow and possible code execution
• CVE-2025-58060: fix authentication bypass issue caused by not checking password when AuthType is not Basic.

• CVE-2023-4504: validate length of attacker-crafted PPD PostScript documents to prevent heap-based buffer overflow and possible code execution
• CVE-2025-58060: fix authentication bypass issue caused by not checking password when AuthType is not Basic.

• CVE-2023-4504: validate PPD PostScript input length to prevent heap-based buffer overflow in raster-interpret.c

• CVE-2023-4504: fix heap-based buffer overflow in cups raster-interpret PPD PostScript scanner; scan_ps() in filter/interpret.c now returns NULL on a lone trailing backslash escape sequence rather than reading past the buffer terminator

The updated packages fix security vulnerabilities:

It was discovered that CUPS incorrectly authenticated certain remote requests. A remote attacker could possibly use this issue to obtain recently printed documents. (CVE-2023-32360)

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. (CVE-2023-4504)

These are all security issues fixed in the cups-2.4.2-7.1 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

• CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204).
• CVE-2023-34241: Fixed a use-after-free problem in cupsdAcceptClient() (bsc#1212230).
• CVE-2023-32360: Fixed information leak through Cups-Get-Document operation (bsc#1214254).

This update for cups fixes the following issues:

• CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204).
• CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update for cups fixes the following issues:

• CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204).
• CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update for cups fixes the following issues:

• Version upgrade to 2.4.11: See https://github.com/openprinting/cups/releases CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes. Detailed list (from CHANGES.md):

  • Updated the maximum file descriptor limit for cupsd to 64k-1 (Issue #989)
  • Fixed lpoptions -d with a discovered but not added printer (Issue #833)
  • Fixed incorrect error message for HTTP/IPP errors (Issue #893)
  • Fixed JobPrivateAccess and SubscriptionPrivateAccess support for "all" (Issue #990)
  • Fixed issues with cupsGetDestMediaByXxx (Issue #993)
  • Fixed adding and modifying of printers via the web interface (Issue #998)
  • Fixed HTTP PeerCred authentication for domain users (Issue #1001)
  • Fixed checkbox support (Issue #1008)
  • Fixed printer state notifications (Issue #1013)
  • Fixed IPP Everywhere printer setup (Issue #1033) Issues are those at https://github.com/OpenPrinting/cups/issues In particular CUPS 2.4.11 contains those commit regarding IPP response validation and processing PPD values:
  • "Quote PPD localized strings" https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd plus a cleanup to "Fix warnings for unused vars" https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b

• Version upgrade to 2.4.10: See https://github.com/openprinting/cups/releases CUPS 2.4.10 brings two fixes:

  • Fixed error handling when reading a mixed 1setOf attribute.
  • Fixed scheduler start if there is only domain socket to listen on (Issue #985) which is fix for regression after fix for CVE-2024-35235 in scenarios where is no other listeners in cupsd.conf than domain socket created on demand by systemd, launchd or upstart. Issues are those at https://github.com/OpenPrinting/cups/issues

• Version upgrade to 2.4.9: See https://github.com/openprinting/cups/releases CUPS 2.4.9 brings security fix for CVE-2024-35235 and several bug fixes regarding CUPS Web User Interface, PPD generation and HTTP protocol implementation. Detailed list (from CHANGES.md):

  • Fixed domain socket handling (CVE-2024-35235)
  • Fixed creating of cupsUrfSupported PPD keyword (Issue #952)
  • Fixed searching for destinations in web ui (Issue #954)
  • Fixed TLS negotiation using OpenSSL with servers that require the TLS SNI extension.
  • Really raised cups_enum_dests() timeout for listing available IPP printers (Issue #751)...
  • Fixed Host header regression (Issue #967)
  • Fixed DNS-SD lookups of local services with Avahi (Issue #970)
  • Fixed listing jobs in destinations in web ui. (Apple issue #6204)
  • Fixed showing search query in web ui help page. (Issue #977) Issues are those at https://github.com/OpenPrinting/cups/issues Apple issues are those at https://github.com/apple/cups/issues

• Update to version 2.4.8: See https://github.com/openprinting/cups/releases CUPS 2.4.8 brings many bug fixes which aggregated over the last half a year. It brings the important fix for race conditions and errors which can happen when installing permanent IPP Everywhere printer, support for PAM modules password-auth and system-auth and new option for lpstat which can show only the successful jobs. Detailed list (from CHANGES.md):

  • Added warning if the device has to be asked for 'all,media-col-database' separately (Issue #829)
  • Added new value for 'lpstat' option '-W' - successfull - for getting successfully printed jobs (Issue #830)
  • Added support for PAM modules password-auth and system-auth (Issue #892)
  • Updated IPP Everywhere printer creation error reporting (Issue #347)
  • Updated and documented the MIME typing buffering limit (Issue #925)
  • Raised 'cups_enum_dests()' timeout for listing …

It was discovered that CUPS incorrectly parsed certain Postscript objects. If a user or automated system were tricked into printing a specially crafted document, a remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-6391-1 fixed a vulnerability in CUPS. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that CUPS incorrectly parsed certain Postscript objects. If a user or automated system were tricked into printing a specially crafted document, a remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.