Use-after-free in cups - #VU154077

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the cupsd scheduler's handling of job->filetypes when processing held print jobs that reference printer-private MIME types after the associated temporary queue is deleted. A local user can create a temporary printer queue and submit a held print job referencing its private document format to trigger a crash and cause a denial of service.

Exploitation requires an accepting raw or remote queue configured by an administrator. Creating the temporary queue requires access to the scheduler through an AF_LOCAL connection.

Affected software

Remediation

External References

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-fw5x-gqfr-7jh7

Related Security Bulletins

• Multiple vulnerabilities in cups