{"id":"CVE-2019-2228","aliases":["DEBIAN-CVE-2019-2228","DLA-2047-1","EUVD-2019-11870","GHSA-6xpc-pxw7-qhg3","MGASA-2020-0248","UBUNTU-CVE-2019-2228","USN-4340-1","openSUSE-SU-2024:10707-1"],"status":"published","title":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check...","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00203,"percentile":0.10339,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-12-06T22:40:40Z","modified":"2026-09-21T07:01:02Z","fixes":[{"ecosystem":"Debian:12","package":"cups","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"cups","fixed_in":["1.7.5-11+deb8u7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"cups","fixed_in":["2.1.3-4ubuntu0.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cups","fixed_in":["2.2.7-1ubuntu2.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-11+deb8u7"}]}],"versions":["1.7.5-11","1.7.5-11+deb8u1","1.7.5-11+deb8u2","1.7.5-11+deb8u3","1.7.5-11+deb8u4","1.7.5-11+deb8u5","1.7.5-11+deb8u6"]},{"source":"osv","ecosystem":"Mageia:7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-1.2.mga7"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.11"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5","2.1.3-4ubuntu0.6","2.1.3-4ubuntu0.7","2.1.3-4ubuntu0.8","2.1.3-4ubuntu0.9","2.1.3-4ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu2.8"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1","2.2.7-1ubuntu2.2","2.2.7-1ubuntu2.3","2.2.7-1ubuntu2.4","2.2.7-1ubuntu2.5","2.2.7-1ubuntu2.6","2.2.7-1ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.11"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5","2.1.3-4ubuntu0.6","2.1.3-4ubuntu0.7","2.1.3-4ubuntu0.8","2.1.3-4ubuntu0.9","2.1.3-4ubuntu0.10"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu2.8"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1","2.2.7-1ubuntu2.2","2.2.7-1ubuntu2.3","2.2.7-1ubuntu2.4","2.2.7-1ubuntu2.5","2.2.7-1ubuntu2.6","2.2.7-1ubuntu2.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-9ubuntu1.1"}]}],"versions":["2.2.12-2ubuntu1","2.3.0-6","2.3.0-7","2.3.0-7ubuntu1","2.3.1-1ubuntu1","2.3.1-2","2.3.1-4","2.3.1-7","2.3.1-9ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3op2-4.2"}]}],"bundled":20}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/security/bulletin/2019-12-01","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4340-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2228"},{"url":"https://github.com/advisories/GHSA-6xpc-pxw7-qhg3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-2228","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0248.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26531","tags":["report"]},{"url":"https://usn.ubuntu.com/4105-1/","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-8842","tags":["advisory"]},{"url":"https://github.com/apple/cups/releases/tag/v2.2.12","tags":["web"]},{"url":"https://github.com/apple/cups/releases/tag/v2.2.13","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-2228","tags":["report"]},{"url":"https://android.googlesource.com/platform/external/libcups/+/5fb2ccdf3347f61b570c8e340f90db5cd28b29bc","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4340-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-3898","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25317","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-2228","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2019-12-06T22:40:40Z","modified":"2024-08-04T18:42:51.106Z","updated_at":"2026-11-02T14:20:22.3662Z"}],"euvd":[{"id":"EUVD-2019-11870","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2019-12-06T22:40:40Z","modified":"2024-08-04T18:42:51Z","updated_at":"2026-11-03T03:06:56.04689Z"}],"ghsa":[{"id":"GHSA-6xpc-pxw7-qhg3","title":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check...","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2022-05-24T17:02:51Z","modified":"2023-01-29T05:00:36Z","updated_at":"2026-11-02T14:44:37.925447Z"}],"nvd":[{"id":"CVE-2019-2228","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2019-12-06T23:15:12.677Z","modified":"2026-06-17T02:33:28.717Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-2228","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2019-12-06T23:15:12.677Z","modified":"2026-04-16T04:34:59.242098319Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-2228","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2019-12-06T23:15:12.677Z","modified":"2026-09-21T07:01:02.234188522Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-2228","description":"In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196","status":"published","published":"2019-12-06T23:15:00Z","modified":"2026-04-22T12:17:21.473494Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2047-1","title":"cups - security update","status":"published","published":"2019-12-22T00:00:00Z","modified":"2026-03-09T01:20:21.335728Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0248","title":"Updated cups packages fix security vulnerability","description":"Updated cups packages fix security vulnerabilities:\n\nIt was discovered that CUPS incorrectly handled certain language values.\nA local attacker could possibly use this issue to cause CUPS to crash,\nleading to a denial of service, or possibly obtain sensitive information\n(CVE-2019-2228).\n\nStephan Zeisberg discovered that the CUPS SNMP backend incorrectly\nhandled encoded ASN.1 inputs. A remote attacker could possibly use this\nissue to cause CUPS to crash by providing specially crafted network\ntraffic (CVE-2019-8675, CVE-2019-8696).\n\nThe ippReadIO function may under-read an extension (CVE-2019-8842).\n\nStephan Zeisberg discovered that CUPS incorrectly handled certain\nmalformed ppd files. A local attacker could possibly use this issue to\nexecute arbitrary code (CVE-2020-3898).\n\nThe cups package has been updated to version 2.2.13 and patched to fix\nthese issues and other bugs.\n\nAlso, this update will hopefully fix the cups service failing to start at\nboot on some systems. \n","status":"published","published":"2020-06-10T22:26:12Z","modified":"2026-04-16T04:44:26.010940877Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10707-1","title":"cups-2.3.3op2-4.2 on GA media","description":"These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:44.838396Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4340-1","title":"cups vulnerabilities","description":"It was discovered that CUPS incorrectly handled certain language values. A\nlocal attacker could possibly use this issue to cause CUPS to crash,\nleading to a denial of service, or possibly obtain sensitive information.\nThis issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu\n19.10. (CVE-2019-2228)\n\nStephan Zeisberg discovered that CUPS incorrectly handled certain malformed\nppd files. A local attacker could possibly use this issue to execute\narbitrary code. (CVE-2020-3898)\n","status":"published","published":"2020-04-27T15:18:48Z","modified":"2026-04-22T10:05:06.390484Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}