Homepage
About Snyk

Out-of-Bounds Affecting cups package, versions <1.5.0-8

0.0
medium

Snyk CVSS

    Attack Complexity High

    Threat Intelligence

    EPSS 1.75% (88th percentile)
Expand this section
NVD
5.6 medium
Expand this section
Red Hat
5.6 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN8-CUPS-364560
  • published 19 Aug 2011
  • disclosed 19 Aug 2011
Report a new vulnerability Found a mistake?

Introduced: 19 Aug 2011

CVE-2011-2896 Open this link in a new tab
CWE-119 Open this link in a new tab

How to fix?

Upgrade Debian:8 cups to version 1.5.0-8 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cups package and not the cups package as distributed by Debian. See How to fix? for Debian:8 relevant fixed versions and status.

The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

References