Out-of-bounds read in CUPS - CVE-2019-8842

Vulnerability identifier: #VU27378

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8842

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within ippReadIO function. A remote attacker can pass specially crafted document to the service, trigger out-of-bounds read error and read contents of memory on the system or crash the service.

CUPS
cups (Alpine package)
cups (Ubuntu package)
cups
cups-debugsource
cups-debuginfo
cups-libs
cups-devel
cups-help
Ubuntu
openEuler

Install updates from vendor's website.

CUPS - update to 2.3.3
cups (Ubuntu package) - addressed in versions 2.1.34ubuntu0.11+esm1, 2.2.7-1ubuntu2.9, 2.3.1-9ubuntu1.2, 2.3.3op2-7ubuntu2.1, 2.4.1op1-1ubuntu4.1
cups - update to 2.2.13-11
cups-debugsource - update to 2.2.13-11
cups-debuginfo - update to 2.2.13-11
cups-libs - update to 2.2.13-11
cups-devel - update to 2.2.13-11
cups-help - update to 2.2.13-11

• https://github.com/apple/cups/releases/tag/v2.3.3

• Remote code execution in cups
• Out-of-bounds read in cups (Alpine package)
• Ubuntu update for cups
• Ubuntu update for cups
• openEuler update for cups