p PatchFirst

CVE-2023-4504

CVE-2023-4504 · OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

CVSS 7.0 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cups

    Versions
    • ≥ 0, < 2.4.6: Affected (semver)

    Update to 2.4.6

  • libppd

    Versions
    • ≥ 0, < d09348b: Affected (git)

    No fix published

  • cups Debian:12

    Versions
    • 2.4.2-3
    • 2.4.2-3+deb12u1
    Affected ranges
    • ECOSYSTEM: < 2.4.2-3+deb12u2

    Update to 2.4.2-3+deb12u2

  • cups Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.2-6

    Update to 2.4.2-6

  • cups Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.2-6

    Update to 2.4.2-6

  • cups Ubuntu:Pro:16.04:LTS

    Versions
    • 2.1.0-4ubuntu3
    • 2.1.0-5
    • 2.1.0-6
    • 2.1.0-6ubuntu1
    • 2.1.0-7
    • 2.1.2-1
    • 2.1.2-2
    • 2.1.3-1
    • 2.1.3-1build1
    • 2.1.3-3
    • 2.1.3-4
    • 2.1.3-4ubuntu0.2
    • 2.1.3-4ubuntu0.3
    • 2.1.3-4ubuntu0.4
    • 2.1.3-4ubuntu0.5
    • 2.1.3-4ubuntu0.6
    • 2.1.3-4ubuntu0.7
    • 2.1.3-4ubuntu0.8
    • 2.1.3-4ubuntu0.9
    • 2.1.3-4ubuntu0.10
    • 2.1.3-4ubuntu0.11
    • 2.1.3-4ubuntu0.11+esm1
    • 2.1.3-4ubuntu0.11+esm2
    • 2.1.3-4ubuntu0.11+esm3
    Affected ranges
    • ECOSYSTEM: < 2.1.3-4ubuntu0.11+esm4

    Update to 2.1.3-4ubuntu0.11+esm4

  • libppd Ubuntu:16.04:LTS

    Versions
    • 2:0.10-7.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cups Ubuntu:Pro:18.04:LTS

    Versions
    • 2.2.4-7ubuntu2
    • 2.2.5-2
    • 2.2.6-2
    • 2.2.6-3
    • 2.2.6-4
    • 2.2.6-5
    • 2.2.7-1ubuntu1
    • 2.2.7-1ubuntu2
    • 2.2.7-1ubuntu2.1
    • 2.2.7-1ubuntu2.2
    • 2.2.7-1ubuntu2.3
    • 2.2.7-1ubuntu2.4
    • 2.2.7-1ubuntu2.5
    • 2.2.7-1ubuntu2.6
    • 2.2.7-1ubuntu2.7
    • 2.2.7-1ubuntu2.8
    • 2.2.7-1ubuntu2.9
    • 2.2.7-1ubuntu2.10
    • 2.2.7-1ubuntu2.10+esm1
    Affected ranges
    • ECOSYSTEM: < 2.2.7-1ubuntu2.10+esm2

    Update to 2.2.7-1ubuntu2.10+esm2

  • libppd Ubuntu:18.04:LTS

    Versions
    • 2:0.10-7.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cups Ubuntu:20.04:LTS

    Versions
    • 2.2.12-2ubuntu1
    • 2.3.0-6
    • 2.3.0-7
    • 2.3.0-7ubuntu1
    • 2.3.1-1ubuntu1
    • 2.3.1-2
    • 2.3.1-4
    • 2.3.1-7
    • 2.3.1-9ubuntu1
    • 2.3.1-9ubuntu1.1
    • 2.3.1-9ubuntu1.2
    • 2.3.1-9ubuntu1.3
    • 2.3.1-9ubuntu1.4
    • 2.3.1-9ubuntu1.5
    Affected ranges
    • ECOSYSTEM: < 2.3.1-9ubuntu1.6

    Update to 2.3.1-9ubuntu1.6

  • libppd Ubuntu:20.04:LTS

    Versions
    • 2:0.10-7.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cups Ubuntu:22.04:LTS

    Versions
    • 2.3.3op2-7ubuntu2
    • 2.4.1op1-1ubuntu1
    • 2.4.1op1-1ubuntu2
    • 2.4.1op1-1ubuntu3
    • 2.4.1op1-1ubuntu4
    • 2.4.1op1-1ubuntu4.1
    • 2.4.1op1-1ubuntu4.2
    • 2.4.1op1-1ubuntu4.4
    • 2.4.1op1-1ubuntu4.6
    Affected ranges
    • ECOSYSTEM: < 2.4.1op1-1ubuntu4.7

    Update to 2.4.1op1-1ubuntu4.7

  • libppd Ubuntu:22.04:LTS

    Versions
    • 2:0.10-7.3
    • 2:0.10-8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →