p PatchFirst

CVE-2025-57812

CVE-2025-57812 · [BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

CVSS 3.7 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libcupsfilters

    Versions
    • cups-filters <= 1.28.17: Affected
    • libcupsfilters >= 2.0.0, < 2.1.1: Affected

    No fix published

  • cups-filters Debian:12

    Versions
    • 1.28.17-3
    • 1.28.17-3+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.28.17-3+deb12u2

    Update to 1.28.17-3+deb12u2

  • cups-filters Debian:13

    Versions
    • 1.28.17-6
    Affected ranges
    • ECOSYSTEM: < 1.28.17-6+deb13u1

    Update to 1.28.17-6+deb13u1

  • cups-filters Debian:14

    Versions
    • 1.28.17-6
    Affected ranges
    • ECOSYSTEM: < 1.28.17-7

    Update to 1.28.17-7

  • libcupsfilters Debian:13

    Versions
    • 2.0.0-3
    Affected ranges
    • ECOSYSTEM: < 2.0.0-3+deb13u1

    Update to 2.0.0-3+deb13u1

  • libcupsfilters Debian:14

    Versions
    • 2.0.0-3
    • 2.1.1-1
    Affected ranges
    • ECOSYSTEM: < 2.1.1-2

    Update to 2.1.1-2

  • cups-filters Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.76-1
    • 1.1.0-1
    • 1.1.0-1build1
    • 1.3.0-1
    • 1.4.0-1
    • 1.5.0-1
    • 1.6.0-1
    • 1.7.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-2ubuntu2
    • 1.8.2-2ubuntu3
    • 1.8.3-2ubuntu1
    • 1.8.3-2ubuntu2
    • 1.8.3-2ubuntu3
    • 1.8.3-2ubuntu3.1
    • 1.8.3-2ubuntu3.4
    • 1.8.3-2ubuntu3.5
    • 1.8.3-2ubuntu3.5+esm1
    • 1.8.3-2ubuntu3.5+esm2
    Affected ranges
    • ECOSYSTEM: < 1.8.3-2ubuntu3.5+esm3

    Update to 1.8.3-2ubuntu3.5+esm3

  • cups-filters Ubuntu:Pro:18.04:LTS

    Versions
    • 1.17.9-0ubuntu1
    • 1.17.9-1
    • 1.20.0-2
    • 1.20.1-1
    • 1.20.1-1build1
    • 1.20.2-0ubuntu1
    • 1.20.2-0ubuntu2
    • 1.20.2-0ubuntu3
    • 1.20.2-0ubuntu3.1
    • 1.20.2-0ubuntu3.3
    • 1.20.2-0ubuntu3.3+esm1
    Affected ranges
    • ECOSYSTEM: < 1.20.2-0ubuntu3.3+esm2

    Update to 1.20.2-0ubuntu3.3+esm2

  • cups-filters Ubuntu:Pro:20.04:LTS

    Versions
    • 1.25.11-0ubuntu1
    • 1.25.11-1
    • 1.25.12-1
    • 1.25.13-1
    • 1.26.0-1
    • 1.26.1-1
    • 1.26.2-1
    • 1.27.0-1
    • 1.27.0-2
    • 1.27.1-1
    • 1.27.1-2
    • 1.27.1-3
    • 1.27.2-1
    • 1.27.3-1
    • 1.27.4-1
    • 1.27.4-1ubuntu0.2
    • 1.27.4-1ubuntu0.3
    • 1.27.4-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 1.27.4-1ubuntu0.4+esm1

    Update to 1.27.4-1ubuntu0.4+esm1

  • cups-filters Ubuntu:22.04:LTS

    Versions
    • 1.28.10-2
    • 1.28.11-1
    • 1.28.11-2
    • 1.28.12-1
    • 1.28.13-0ubuntu1
    • 1.28.14-1
    • 1.28.15-0ubuntu1
    • 1.28.15-0ubuntu1.2
    • 1.28.15-0ubuntu1.3
    • 1.28.15-0ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 1.28.15-0ubuntu1.5

    Update to 1.28.15-0ubuntu1.5

  • libcupsfilters Ubuntu:24.04:LTS

    Versions
    • 2.0.0-0ubuntu1
    • 2.0.0-0ubuntu6
    • 2.0.0-0ubuntu7
    • 2.0.0-0ubuntu7.1
    Affected ranges
    • ECOSYSTEM: < 2.0.0-0ubuntu7.2

    Update to 2.0.0-0ubuntu7.2

  • libcupsfilters Ubuntu:25.10

    Versions
    • 2.1.1-0ubuntu2
    • 2.1.1-0ubuntu3
    Affected ranges
    • ECOSYSTEM: < 2.1.1-0ubuntu3.1

    Update to 2.1.1-0ubuntu3.1

Original sources

Check your server →