Heap-based buffer overflow in cups - #VU155774

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the get_options() and ipp_length() functions in cupsd when processing IPP Print-Job requests containing many INT_MIN resolution values. A local user can submit a specially crafted request that causes subsequent unbounded string copies to write beyond the allocated options buffer to cause a denial of service.

Exploitation requires at least one existing print queue. The default configuration exposes the service through loopback and domain-socket listeners, and the Print-Job operation does not require authentication.

Affected software

Remediation

External References

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-56v5-mj3w-4f59

Related Security Bulletins

• Multiple vulnerabilities in cups