CVE-2023-4504

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4504
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

7.0 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/OpenPrinting/cups/releases/tag/v2.4.7 Release Notes
https://github.com/OpenPrinting/cups/releases/tag/v2.4.7 Release Notes
https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h Exploit Vendor Advisory
https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h Exploit Vendor Advisory
https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 Exploit Vendor Advisory
https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00041.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00041.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXPVADB56NMLJWG4IZ3OZBNJ2ZOLPQJ6/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXPVADB56NMLJWG4IZ3OZBNJ2ZOLPQJ6/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/ Mailing List Release Notes
https://takeonme.org/cves/CVE-2023-4504.html Exploit
https://takeonme.org/cves/CVE-2023-4504.html Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*
cpe:2.3:a:openprinting:libppd:2.0:rc2:*:*:*:linux:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

13 Feb 2025, 18:15

Type Values Removed Values Added
Summary Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
References (MISC) https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 - Exploit, Vendor Advisory () https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 - Exploit, Vendor Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/ - Mailing List, Release Notes () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WHEJIYMMAIXU2EC35MGTB5LGGO2FFJE/ - Mailing List, Release Notes
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/ - Mailing List, Release Notes () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AMYDKIE4PSJDEMC5OWNFCDMHFGLJ57XG/ - Mailing List, Release Notes
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/ - Mailing List, Release Notes () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5WVS4I7JG3LISFPKTM6ADKJXXEPEEWBQ/ - Mailing List, Release Notes
References (MISC) https://takeonme.org/cves/CVE-2023-4504.html - Exploit () https://takeonme.org/cves/CVE-2023-4504.html - Exploit
References (MISC) https://github.com/OpenPrinting/cups/releases/tag/v2.4.7 - Release Notes () https://github.com/OpenPrinting/cups/releases/tag/v2.4.7 - Release Notes
References (MISC) https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h - Exploit, Vendor Advisory () https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h - Exploit, Vendor Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/ - Mailing List, Release Notes () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2GSPQAFK2Z6L57TRXEKZDF42K2EVBH7/ - Mailing List, Release Notes
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXPVADB56NMLJWG4IZ3OZBNJ2ZOLPQJ6/ - Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXPVADB56NMLJWG4IZ3OZBNJ2ZOLPQJ6/ - Third Party Advisory
References (MISC) https://lists.debian.org/debian-lts-announce/2023/09/msg00041.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/09/msg00041.html - Mailing List, Third Party Advisory

09 Nov 2023, 20:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 7.0

16 Oct 2023, 19:32

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-21 23:15

Updated : 2025-04-23 17:16

NVD link : CVE-2023-4504

Mitre link : CVE-2023-4504

JSON object : View

Products Affected

debian

  • debian_linux

openprinting

  • libppd
  • cups

fedoraproject

  • fedora
CWE
CWE-787

Out-of-bounds Write