PT-2024-12850 · Cups · Cups

Published 2023-11-01 · Updated 2024-12-13 · CVE-2023-40112

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CUPS (affected versions not specified)

Description The issue is related to a missing bounds check in the ippSetValueTag function of ipp.c, which could lead to a possible out of bounds read. This might result in local information disclosure of past print jobs or other print-related information, without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ASB-A-168903843

CVE-2023-40112

Affected Products

Cups

References · 9

• https://source.android.com/security/bulletin/2023-11-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40112 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40112 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-168903843 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d7cb53cb5b47f4afdb84cb0e161d84fdc2c32ce7 · Patch
• https://twitter.com/VulmonFeeds/status/1758304479227605331 · Twitter Post
• https://t.me/cvenotify/100150 · Telegram Post
• https://twitter.com/CVEnew/status/1758259685348495706 · Twitter Post
• https://t.me/cvenotify/104285 · Telegram Post