Skip to content
OpenAdvisories
Medium ALAS2-2023-2109 1 CVE

Moderate: cups security update (Amazon Linux 2)

Published Jul 5, 2023 · Updated Jul 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34241: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately before the connection closed, resulting in a use-after-free in cupsdAcceptClient() in scheduler/client.c

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 cups 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-client 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-debuginfo 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-devel 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-filesystem 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-ipptool 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-libs 1:1.6.3-51.amzn2.0.1
Amazon Linux · 2 cups-lpd 1:1.6.3-51.amzn2.0.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-34241

    CUPS vulnerable to use-after-free in cupsdAcceptClient()

    OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been close…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-34241.html