Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-34241 EUVD-2023-38329

CUPS vulnerable to use-after-free in cupsdAcceptClient()

Published Jun 22, 2023 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: OpenPrinting Product: cups Package: cups Package: cups Package: cups Package: cups Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.

The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.

Version 2.4.6 has a patch for this issue.

Affected products

VendorProductAffectedFixed
OpenPrinting cups >= 2.0.0, < 2.4.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cups 2.4.2-5 —
Debian 13 cups 2.4.2-5 —
Debian 12 cups 2.4.2-3+deb12u1 —
Debian 10 cups 2.2.10-6+deb10u8 DLA-3476-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS cups 2.4.1op1-1ubuntu4.4 USN-6184-1
Ubuntu 20.04 LTS cups 2.3.1-9ubuntu1.4 USN-6184-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS cups 2.2.7-1ubuntu2.10+esm1 USN-6184-2
Ubuntu Pro 16.04 LTS cups 2.1.3-4ubuntu0.11+esm3 USN-6184-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 cups +7 1:2.3.3op2-21.el9 RHSA-2023:6596
RHEL 8 cups +6 1:2.2.6-54.el8_9 RHSA-2023:7165
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 EUS cups +6 1:2.2.6-51.el8_8.3 RHSA-2024:1409
RHEL 8.6 EUS cups +6 1:2.2.6-45.el8_6.4 RHSA-2024:1101

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 cups +7 1:2.3.3op2-21.el9 ALSA-2023:6596
AlmaLinux 8 cups +6 1:2.2.6-54.el8_9 ALSA-2023:7165

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES 15 SP4 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES 15 SP3 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES 15 SP2 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES 15 SP1 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
Show 22 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SLES 12 SP4 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SLES 12 SP2 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SLES for SAP 15 SP3 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES for SAP 15 SP2 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES for SAP 15 SP1 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLES for SAP 12 SP5 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SLES for SAP 12 SP4 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SLE Real Time 15 SP3 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLE Micro 6.0 cups 2.4.11-1.1 SUSE-SU-2025:20090-1
SLE Micro 5.4 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLE Micro 5.3 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLE Micro 5.2 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLE HPC 15 SP3 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLE HPC 15 SP2 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SLE HPC 15 SP1 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SUSE OpenStack Cloud Crowbar 9 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SUSE OpenStack Cloud 9 cups 1.7.5-20.46.1 SUSE-SU-2023:3706-1
SUSE Manager Server 4.2 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SUSE Manager Proxy 4.2 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SUSE Enterprise Storage 7.1 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
SUSE Enterprise Storage 7 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed cups 2.4.2-6.1 openSUSE-SU-2024:13017-1
openSUSE Leap 15.5 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
openSUSE Leap 15.4 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.3 cups 2.2.7-150000.3.46.1 SUSE-SU-2023:2616-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.17 cups 2.4.2-r3 —
Alpine v3.16 cups 2.4.2-r2 —
Alpine v3.15 cups 2.3.3-r8 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cups +7 1:2.3.3op2-18.amzn2023.0.5 ALAS2023-2023-235
Amazon Linux 2 cups +6 1:1.6.3-51.amzn2.0.1 ALAS2-2023-2109

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cups 2.4.10-1 —
Azure Linux 2 (CBL-Mariner) cups 2.3.3op2-7 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 cups +7 1:2.3.3op2-21.el9 ELSA-2023-6596
Oracle Linux 8 cups +6 1:2.2.6-54.el8_9 ELSA-2023-7165

Advisories 20

References