Lucene search

DebianDEBIAN:DLA-3594-1:3623D

HistorySep 30, 2023 - 5:30 p.m.

[SECURITY] [DLA 3594-1] cups security update

2023-09-3017:30:31

lists.debian.org

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

Low

3.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

14.4%

JSON

Debian LTS Advisory DLA-3594-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
September 30, 2023 https://wiki.debian.org/LTS

Package : cups
Version : 2.2.10-6+deb10u9
CVE ID : CVE-2023-4504 CVE-2023-32360
Debian Bug : #1051953

Two issues have been found in cups, the Common UNIX Printing System™.

CVE-2023-4504

Due to missing boundary checks a heap-based buffer overflow and code
execution might be possible by using crafted postscript documents.

CVE-2023-32360

Unauthorized users might be allowed to fetch recently printed documents.

Since this is a configuration fix, it might be that it does not reach
you if you are updating the package.
Please double check your /etc/cups/cupds.conf file, whether it limits
the access to CUPS-Get-Document with something like the following
> <Limit CUPS-Get-Document>
> AuthType Default
> Require user @OWNER @SYSTEM
> Order deny,allow
> </Limit>
(The important line is the 'AuthType Default' in this section)

For Debian 10 buster, these problems have been fixed in version
2.2.10-6+deb10u9.

We recommend that you upgrade your cups packages.

For the detailed security status of cups please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cups

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allcups-ppdc< 2.2.10-6+deb10u9cups-ppdc_2.2.10-6+deb10u9_all.deb
Debian10allcups< 2.2.10-6+deb10u9cups_2.2.10-6+deb10u9_all.deb
Debian10alllibcups2< 2.2.10-6+deb10u9libcups2_2.2.10-6+deb10u9_all.deb
Debian10allcups-daemon< 2.2.10-6+deb10u9cups-daemon_2.2.10-6+deb10u9_all.deb
Debian10allcups-client< 2.2.10-6+deb10u9cups-client_2.2.10-6+deb10u9_all.deb
Debian10allcups-ipp-utils< 2.2.10-6+deb10u9cups-ipp-utils_2.2.10-6+deb10u9_all.deb
Debian10allcups-server-common< 2.2.10-6+deb10u9cups-server-common_2.2.10-6+deb10u9_all.deb
Debian10allcups-bsd< 2.2.10-6+deb10u9cups-bsd_2.2.10-6+deb10u9_all.deb
Debian10alllibcupsimage2< 2.2.10-6+deb10u9libcupsimage2_2.2.10-6+deb10u9_all.deb
Debian10allcups-core-drivers< 2.2.10-6+deb10u9cups-core-drivers_2.2.10-6+deb10u9_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	cups-ppdc	< 2.2.10-6+deb10u9	cups-ppdc_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups	< 2.2.10-6+deb10u9	cups_2.2.10-6+deb10u9_all.deb
Debian	10	all	libcups2	< 2.2.10-6+deb10u9	libcups2_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups-daemon	< 2.2.10-6+deb10u9	cups-daemon_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups-client	< 2.2.10-6+deb10u9	cups-client_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups-ipp-utils	< 2.2.10-6+deb10u9	cups-ipp-utils_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups-server-common	< 2.2.10-6+deb10u9	cups-server-common_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups-bsd	< 2.2.10-6+deb10u9	cups-bsd_2.2.10-6+deb10u9_all.deb
Debian	10	all	libcupsimage2	< 2.2.10-6+deb10u9	libcupsimage2_2.2.10-6+deb10u9_all.deb
Debian	10	all	cups-core-drivers	< 2.2.10-6+deb10u9	cups-core-drivers_2.2.10-6+deb10u9_all.deb