Skip to content
OpenAdvisories
Medium ALAS2-2023-2293 1 CVE

Moderate: cups security update (Amazon Linux 2)

Published Oct 12, 2023 · Updated Oct 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4504: A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an attacker-crafted CUPS document, possibly leading to a heap-based buffer overflow and code execution.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 cups 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-client 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-debuginfo 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-devel 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-filesystem 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-ipptool 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-libs 1:1.6.3-51.amzn2.0.4
Amazon Linux · 2 cups-lpd 1:1.6.3-51.amzn2.0.4

Vulnerabilities 1

  • High 7.0
    CVE-2023-4504 Public exploit

    OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

    Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in Septembe…

    OpenPrinting cups libppd cups Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-4504.html