Lucene search

K
osvGoogleOSV:USN-6844-2
HistoryJun 28, 2024 - 4:08 p.m.

cups regression

2024-06-2816:08:04
Google
osv.dev
usn-6844-1
cups package
cupsd daemon
listen configuration
vulnerability
regression
fix

7.4 High

AI Score

Confidence

Low

USN-6844-1 fixed vulnerabilities in the CUPS package. The update
lead to the discovery of a regression in CUPS with regards to
how the cupsd daemon handles Listen configuration directive.
This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:
Rory McNamara discovered that when starting the cupsd server with a
Listen configuration item, the cupsd process fails to validate if
bind call passed. An attacker could possibly trick cupsd to perform
an arbitrary chmod of the provided argument, providing world-writable
access to the target.

7.4 High

AI Score

Confidence

Low