Summary
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.
Security Fix(es):
* cups: heap buffer overflow may lead to DoS (CVE-2023-32324)
* cups: use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | cups | 1:2.2.6-54.el8_9 |
| AlmaLinux · 8 | cups-client | 1:2.2.6-54.el8_9 |
| AlmaLinux · 8 | cups-devel | 1:2.2.6-54.el8_9 |
| AlmaLinux · 8 | cups-filesystem | 1:2.2.6-54.el8_9 |
| AlmaLinux · 8 | cups-ipptool | 1:2.2.6-54.el8_9 |
| AlmaLinux · 8 | cups-libs | 1:2.2.6-54.el8_9 |
| AlmaLinux · 8 | cups-lpd | 1:2.2.6-54.el8_9 |
Vulnerabilities 2
-
High 7.5
OpenPrinting CUPS vulnerable to heap buffer overflow
OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` …
-
Medium 5.3
CUPS vulnerable to use-after-free in cupsdAcceptClient()
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been close…