OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
Vulnerability Description
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4504
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- zenofex
- WanderingGlitch
- Austin Hackers Anonymous!
References
- https://takeonme.org/cves/CVE-2023-4504.html
- https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/
- https://lists.debian.org/debian-lts-announce/2023/09/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXPVADB56NMLJWG4IZ3OZBNJ2ZOLPQJ6/
More from OpenPrinting
View All →Affected Vendor
OpenPrinting
View all reports →