CVE-2023-32324

01.06.2023, 17:15

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 35%

Affected Products (NVD)

Vendor	Product	Version
openprinting	cups	𝑥 ≤ 2.4.2
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

cups

bookworm	2.4.2-3+deb12u8 fixed
bookworm (security)	2.4.2-3+deb12u8 fixed
bullseye	2.3.3op2-3+deb11u8 fixed
bullseye (security)	2.3.3op2-3+deb11u9 fixed
sid	2.4.10-2 fixed
trixie	2.4.10-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

cups

bionic	Fixed 2.2.7-1ubuntu2.10 released
focal	Fixed 2.3.1-9ubuntu1.3 released
jammy	Fixed 2.4.1op1-1ubuntu4.2 released
kinetic	Fixed 2.4.2-1ubuntu2.1 released
lunar	Fixed 2.4.2-3ubuntu2.1 released
trusty	ignored
xenial	Fixed 2.1.3-4ubuntu0.11+esm2 released

openSUSE / SLES Releases

openSUSE Product

Release

cups

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 12 SP5	1.7.5-20.39.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 12 SP2	1.7.5-20.39.1 fixed
suse enterprise server 12 SP3	1.7.5-20.39.1 fixed
suse enterprise server 12 SP4	1.7.5-20.39.1 fixed
suse enterprise server 12 SP5	1.7.5-20.39.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

cups-client

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 12 SP5	1.7.5-20.39.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 12 SP2	1.7.5-20.39.1 fixed
suse enterprise server 12 SP3	1.7.5-20.39.1 fixed
suse enterprise server 12 SP4	1.7.5-20.39.1 fixed
suse enterprise server 12 SP5	1.7.5-20.39.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

cups-config

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

cups-ddk

suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed

cups-devel

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

cups-libs

suse enterprise sap 12 SP5	1.7.5-20.39.1 fixed
suse enterprise server 12 SP2	1.7.5-20.39.1 fixed
suse enterprise server 12 SP3	1.7.5-20.39.1 fixed
suse enterprise server 12 SP4	1.7.5-20.39.1 fixed
suse enterprise server 12 SP5	1.7.5-20.39.1 fixed

cups-libs-32bit

suse enterprise sap 12 SP5	1.7.5-20.39.1 fixed
suse enterprise server 12 SP2	1.7.5-20.39.1 fixed
suse enterprise server 12 SP3	1.7.5-20.39.1 fixed
suse enterprise server 12 SP4	1.7.5-20.39.1 fixed
suse enterprise server 12 SP5	1.7.5-20.39.1 fixed

libcups2

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

libcups2-32bit

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed

libcupscgi1

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

libcupsimage2

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

libcupsmime1

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

libcupsppdc1

suse enterprise desktop 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise desktop 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise sap 15 SP7	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP1	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP2	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP3	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP4	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP5	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP6	2.2.7-150000.3.43.1 fixed
suse enterprise server 15 SP7	2.2.7-150000.3.43.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

cups

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-client

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-devel

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-filesystem

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-ipptool

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-libs

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-lpd

RHEL 8	1:2.2.6-54.el8_9 fixed
RHEL 8.6 AUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 E4S	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 EUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.6 TUS	1:2.2.6-45.el8_6.4 fixed
RHEL 8.8 AUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 E4S	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 EUS	1:2.2.6-51.el8_8.3 fixed
RHEL 8.8 TUS	1:2.2.6-51.el8_8.3 fixed
RHEL 9	1:2.3.3op2-21.el9 fixed

cups-printerapp

RHEL 9

1:2.3.3op2-21.el9

fixed

Known Exploits!

Common Weakness Enumeration

References

https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7

https://lists.debian.org/debian-lts-announce/2023/06/msg00001.html

https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7

https://lists.debian.org/debian-lts-announce/2023/06/msg00001.html