CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 1CVE-2023-34241 – CUPS vulnerable to use-after-free in cupsdAcceptClient()
https://notcve.org/view.php?id=CVE-2023-34241
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. • http://www.openwall.com/lists/oss-security/2023/06/23/10 http://www.openwall.com/lists/oss-security/2023/06/26/1 https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2 https://github.com/OpenPrinting/cups/releases/tag/v2.4.6 https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 https://lists.debian.org/debian-lts-announce/2023/06/msg00038.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7I7DWGYGE • CWE-416: Use After Free •
CVSS: 7.2EPSS: 0%CPEs: 24EXPL: 0CVE-2022-26691 – cups: authorization bypass when using "local" authorization
https://notcve.org/view.php?id=CVE-2022-26691
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges. Se abordó un problema de lógica con una administración de estados mejorada. Este problema es corregido en Security Update 2022-003 Catalina, macOS Monterey versión 12.3, macOS Big Sur versión 11.6.5. • https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444 https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0026/MNDT-2022-0026.md https://lists.debian.org/debian-lts-announce/2022/05/msg00039.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQ6TD7F3VRITPEHFDHZHK7MU6FEBMZ5U https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQRIT4H75XV6M42K7ZTARWZ7YLLYQHPO https://support.apple.com/en-us/H • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-697: Incorrect Comparison •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-4300 – cups: Session cookie generated by the CUPS web interface is easy to guess
https://notcve.org/view.php?id=CVE-2018-4300
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10. La cookie de sesión generada por la interfaz web de CUPS era fácil de adivinar en Linux, permitiendo un acceso de script no autorizado a la interfaz web cuando está deshabilitada. Este problema afectaba a las versiones anteriores a la v2.2.10. • http://www.securityfocus.com/bid/107785 https://github.com/apple/cups/releases/tag/v2.2.10 https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html https://access.redhat.com/security/cve/CVE-2018-4300 https://bugzilla.redhat.com/show_bug.cgi?id=1695929 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-330: Use of Insufficiently Random Values •
CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 2CVE-2017-18248
https://notcve.org/view.php?id=CVE-2017-18248
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification. La función add_job en scheduler/ipp.c en CUPS, en versiones anteriores a la 2.2.6, cuando un soporte D-Bus está habilitado, podría experimentar un cierre inesperado llevado a cabo por atacantes remotos mediante el envío de tareas de impresión con un nombre de usuario no válido. Esto está relacionado con una notificación D-Bus. • https://github.com/apple/cups/commit/49fa4983f25b64ec29d548ffa3b9782426007df3 https://github.com/apple/cups/issues/5143 https://github.com/apple/cups/releases/tag/v2.2.6 https://lists.debian.org/debian-lts-announce/2018/05/msg00018.html https://lists.debian.org/debian-lts-announce/2018/07/msg00003.html https://security.cucumberlinux.com/security/details.php?id=346 https://usn.ubuntu.com/3713-1 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2017-18190 – cups: DNS rebinding attacks via incorrect whitelist
https://notcve.org/view.php?id=CVE-2017-18190
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1). Una entrada en la lista blanca localhost.localdomain en valid_host() en scheduler/client.c en CUPS, en versiones anteriores a la 2.2.2, permite que atacantes remotos ejecuten comandos IPP arbitrarios mediante el envío de peticiones POST al demonio CUPS junto con reenlaces DNS. El nombre localhost.localdomain suele resolverse mediante un servidor DNS (ni el sistema operativo ni el navegador web son responsables de garantizar que localhost.localdomain sea 127.0.0.1). • https://bugs.chromium.org/p/project-zero/issues/detail?id=1048 https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41 https://lists.debian.org/debian-lts-announce/2018/02/msg00023.html https://lists.debian.org/debian-lts-announce/2018/07/msg00003.html https://usn.ubuntu.com/3577-1 https://access.redhat.com/security/cve/CVE-2017-18190 https://bugzilla.redhat.com/show_bug.cgi?id=1546395 • CWE-284: Improper Access Control CWE-290: Authentication Bypass by Spoofing •