PT-2015-4350 · Apple+4 · Cups+4

Peter De Wachter · Published 2015-02-15 · Updated 2018-10-30 · CVE-2014-9679

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CUPS versions prior to 2.0.2

Description The issue is caused by an integer underflow in the cupsRasterReadPixels function, which can be triggered by a malformed compressed raster file. This can lead to a buffer overflow, allowing remote attackers to have an unspecified impact.

Recommendations For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the cupsRasterReadPixels function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2015_1123

CVE-2014-9679

DLA-159-1

DSA-3172-1

MGASA-2015-0067

RHSA-2015:1123

RHSA-2015_1123

SUSE-SU-2015:0465-1

SUSE-SU-2015:0575-1

SUSE-SU-2015:1011-1

SUSE-SU-2015_0465-1

SUSE-SU-2015_0575-1

USN-2520-1

Affected Products

Cups

Centos

Red Hat

Suse

Ubuntu

References · 62

• https://advisories.mageia.org/MGASA-2015-0067.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:0465-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2520-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3172-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0067 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-1123.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159 · Security Note
• http://ubuntu.com/usn/USN-2520-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/cups · Vendor Advisory
• https://cups.org/str.php?L4551 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9679 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150171.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9679 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9679 · Vendor Advisory