PT-2026-30924 · Openprinting+3 · Cups+3
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenPrinting CUPS versions 2.4.16 and prior
Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. An integer underflow in the
ppdCreateFromIPP() function (cups/ppd-cache.c) allows a local user to crash the cupsd root process by providing a negative job-password-supported IPP attribute. The validation only limits the upper bound, allowing a negative value to pass, which is then cast to size t, wrapping to a large positive value, and used as the length argument to memset() on a 33-byte stack buffer. This results in a SIGSEGV in the cupsd root process, potentially leading to a denial of service when combined with systemd's Restart=on-failure setting.Recommendations
Update to a version of OpenPrinting CUPS later than 2.4.16.
Exploit
Fix
DoS
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cups
Linuxmint
Red Os
Ubuntu