Описание
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large MediaBox value, an attacker can cause CUPS-Filter 1.x’s pdftoraster tool to write beyond the bounds of an array. First, a PDF with a large MediaBox width value causes header.cupsWidth to become large. Next, the calculation of bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8 overflows, resulting in a small value. Then, lineBuf is allocated with the small bytesPerLine size. Finally, convertLineChunked calls writePixel8, which attempts to write to lineBuf outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same bytesPerLine multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c...
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | code not present |
| esm-infra/bionic | released | 1.20.2-0ubuntu3.3+esm2 |
| esm-infra/focal | released | 1.27.4-1ubuntu0.4+esm1 |
| esm-infra/xenial | released | 1.8.3-2ubuntu3.5+esm3 |
| jammy | released | 1.28.15-0ubuntu1.5 |
| noble | not-affected | code not present |
| plucky | not-affected | code not present |
| questing | not-affected | code not present |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | pending | 2.1.1-0ubuntu4 |
| jammy | DNE | |
| noble | released | 2.0.0-0ubuntu7.2 |
| plucky | released | 2.1.1-0ubuntu2.1 |
| questing | released | 2.1.1-0ubuntu3.1 |
| upstream | needs-triage |
Показывать по
4 Medium
CVSS3
Связанные уязвимости
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c597
cups-filters contains backends, filters, and other software required t ...
4 Medium
CVSS3