Vulnerability · Published Jun 1, 2023 · Assigned by GitHub_M
CVE-2023-32324OpenPrinting CUPS vulnerable to heap buffer overflow
High 7.5
In plain English
A high-severity heap buffer overflow in cups from OpenPrinting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | cups | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:8 | cups-client | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups-client | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:8 | cups-devel | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups-devel | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:8 | cups-filesystem | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups-filesystem | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:8 | cups-ipptool | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups-ipptool | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:8 | cups-libs | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups-libs | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:8 | cups-lpd | 1:2.2.6-54.el8_9 | ALSA-2023:7165 |
| AlmaLinux:9 | cups-lpd | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| AlmaLinux:9 | cups-printerapp | 1:2.3.3op2-21.el9 | ALSA-2023:6596 |
| Alpine:v3.20 | cups | 2.4.2-r7 | ALPINE-CVE-2023-32324 |
| Alpine:v3.21 | cups | 2.4.2-r7 | ALPINE-CVE-2023-32324 |
| Alpine:v3.22 | cups | 2.4.2-r7 | ALPINE-CVE-2023-32324 |
| Alpine:v3.23 | cups | 2.4.2-r7 | ALPINE-CVE-2023-32324 |
| Alpine:v3.24 | cups | 2.4.2-r7 | ALPINE-CVE-2023-32324 |
| Debian:12 | cups | 2.4.2-3+deb12u1 | DEBIAN-CVE-2023-32324 |
| Debian:13 | cups | 2.4.2-4 | DEBIAN-CVE-2023-32324 |
| Debian:14 | cups | 2.4.2-4 | DEBIAN-CVE-2023-32324 |
| Ubuntu:22.04:LTS | cups | 2.4.1op1-1ubuntu4.2 | UBUNTU-CVE-2023-32324 |
| Ubuntu:22.04:LTS | cups | 2.4.1op1-1ubuntu4.2 | USN-6128-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenPrinting | cups | <= 2.4.2 |
Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H