PT-2014-1793 · Openprinting+1 · Cups-Filters+1

Florian Weimer + 1 · Published 2014-03-12 · Updated 2024-06-15 · CVE-2013-6475

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cups-filters versions prior to 1.0.53

Description The issue involves multiple vulnerabilities in the cups-filters package that can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, there are multiple integer overflows in the pdftoopvp filter, which can allow remote attackers to execute arbitrary code via a crafted PDF file, triggering a heap-based buffer overflow.

Recommendations For versions prior to 1.0.53, update to version 1.0.53 or later to resolve the issue. As a temporary workaround, consider restricting access to the pdftoopvp filter until a patch is available. Avoid using the cups-filters package with untrusted PDF files until the issue is resolved.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-189

CWE-119

Related Identifiers

ALT-PU-2014-1278

BDU:2015-04125

BDU:2015-09753

CVE-2013-6475

DSA-2875-1

DSA-2876-1

MGASA-2014-0170

OPENSUSE-SU-2024:10313-1

Affected Products

Alt Linux

Cups-Filters

References · 36

• http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7176 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6476 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0170 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09753 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6475 · Security Note
• https://osv.dev/vulnerability/CVE-2013-6475 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6474 · Security Note
• https://advisories.mageia.org/MGASA-2014-0170.html · Security Note
• http://ubuntu.com/usn/USN-2143-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04125 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6475 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6475 · Vendor Advisory
• http://debian.org/security/2014/dsa-2876 · Vendor Advisory
• http://debian.org/security/2014/dsa-2875 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6475 · Vendor Advisory