发布时间: 2023年9月28日
修改时间: 2024年10月31日
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
| NVD | openEuler | |
|---|---|---|
| Confidentiality | High | High |
| Attack Vector | Local | Adjacent |
| CVSS评分 | 7.0 | 8.8 |
| Attack Complexity | High | Low |
| Privileges Required | None | None |
| Scope | Unchanged | Unchanged |
| Integrity | High | High |
| User Interaction | Required | None |
| Availability | High | High |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2023-1910 | cups security update | 2023年10月13日 |
| KylinSec-SA-2023-1906 | cups security update | 2023年10月20日 |
| KylinSec-SA-2023-1930 | cups security update | 2023年9月28日 |
| KylinSec-SA-2023-2279 | cups security update | 2023年9月28日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-4A | cups | Fixed |
| KY3.4-5A | cups | Fixed |
| KY3.5.1 | cups | Fixed |
| KY3.5.2 | cups | Fixed |
