SUSE-SU-2020:14341-1 Security update for cups

This update for cups fixes the following issues: - CVE-2020-3898: Fixed heap buffer overflow in libcups ppdFindOption function bsc1168422...

Scientific Linux Security Update : cups on 7.x i686/x86_64 (2020:1050)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:1050-1 advisory. - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. CVE-2018-4180,...

PT-2020-5330

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.15.4 CUPS affected versions not specified Description A memory corruption issue was addressed with improved validation, which may allow an application to gain elevated privileges. The issue is related to a buffer...

Huawei EulerOS: Security Advisory for cups (EulerOS-SA-2020-1501)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : cups (EulerOS-SA-2020-1501)

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In arrayfind of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in...

EulerOS Virtualization 3.0.2.2 : cups (EulerOS-SA-2020-1461)

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The addjob function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by...

Huawei EulerOS: Security Advisory for cups (EulerOS-SA-2020-1461)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

cups is vulnerable to remote code execution RCE. The attack exists because of LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gifreadlzw function in filter/image-gif.c in CUPS...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. A use-after-free flaw was found in the way the CUPS server parsed Internet Printing Protocol IPP packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server or, potentially, execute arbitrary...

Privilege Escalation

cups is vulnerable to privilege escalation. A possible privilege escalation flaw was found in CUPS. An unprivileged process running as the "lp" user such as a compromised external filter program spawned by the CUPS server could trick the CUPS server into overwriting arbitrary files as the root us...

Denial Of Service (DoS)

cups is vulnerable to denial of service. It was discovered that the Red Hat Security Advisory RHSA-2009:1595 did not fully correct the use-after-free flaw in the way CUPS handled references in its file descriptors-handling interface. A remote attacker could send specially-crafted queries to the...

Information Disclosure

cups is vulnerable to information disclosure. The vulnerability exists as an uninitialized memory read issue was found in the CUPS web interface. If an attacker had access to the CUPS web interface, they could use a specially-crafted URL to leverage this flaw to read a limited amount of memory fr...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. The vulnerability exists as a missing memory allocation failure check flaw, leading to a NULL pointer dereference, was found in the CUPS "texttops" filter. An attacker could create a malicious text file that would cause "texttops" to crash or,...

Cross-site Request Forgery (CSRF)

cups is vulnerable to cross-site request forgery CSRF. The vulnerability exists as a remote attacker could trick a user, who is logged into the CUPS web interface as an administrator, into visiting a specially-crafted website, the attacker could reconfigure and disable CUPS, and gain access to...

Cross-site Scripting (XSS)

The Common UNIX Printing System CUPS is vulnerable to Cross-site Scripting XSS. Several cross-site scripting XSS flaws were found in the way the CUPS web server interface processed HTML form content. If a remote attacker could trick a local user who is logged into the CUPS web interface into...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. An integer overflow flaw, leading to a heap-based buffer overflow, was discovered in the Tagged Image File Format TIFF decoding routines used by the CUPS image-converting filters, "imagetops" and "imagetoraster". An attacker could create a malicious...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. An insufficient buffer bounds checking flaw was discovered in the HP-GL/2-to-PostScript "hpgltops" filter. An attacker could create a malicious HP-GL/2 file that could, possibly, execute arbitrary code as the "lp" user if the file was printed...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. An integer overflow flaw leading to a heap buffer overflow was discovered in the Text-to-PostScript "texttops" filter. An attacker could create a malicious text file that could, possibly, execute arbitrary code as the "lp" user if the file was print...

Arbitrary Code Execution

cups is vulnerable to arbitrary code execution. A buffer overflow flaw was discovered in the SGI image format decoding routines used by the CUPS image converting filter "imagetops". An attacker could create a malicious SGI image file that could, possibly, execute arbitrary code as the "lp" user i...

Denial Of Service (DoS)

cups is vulnerable to denial of service DoS. The vulnerability exists as a use-after-free flaw was found in the CUPS scheduler directory services routine, used to process data about available printers and printer classes...