cups: CVE-2019-2228

Debian Bug report logs - #946782
cups: CVE-2019-2228

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: cups: CVE-2019-2228

Date: Sun, 15 Dec 2019 21:06:42 +0100

Source: cups
Version: 2.3.0-7
Severity: important
Tags: security upstream
Control: found -1 2.2.10-6+deb10u1
Control: found -1 2.2.1-8+deb9u2
Control: found -1 2.2.1-8+deb9u4
Control: found -1 2.2.1-8

Hi,

The following vulnerability was published for cups.

CVE-2019-2228[0]:
| In array_find of array.c, there is a possible out-of-bounds read due
| to an incorrect bounds check. This could lead to local information
| disclosure in the printer spooler with no additional execution
| privileges needed. User interaction is not needed for
| exploitation.Product: AndroidVersions: Android-8.0 Android-8.1
| Android-9 Android-10Android ID: A-111210196


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-2228
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2228

Please adjust the affected versions in the BTS as needed.



-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.3.0-3-amd64 (SMP w/2 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Message #18 received at 946782@bugs.debian.org (full text, mbox, reply):

From: Didier 'OdyX' Raboud <odyx@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 946782@bugs.debian.org

Subject: Re: Bug#946782: cups: CVE-2019-2228

Date: Mon, 16 Dec 2019 07:56:28 +0100

[Message part 1 (text/plain, inline)]

Hello Salvatore, and thanks for your bugreport,

Le dimanche, 15 décembre 2019, 21.06:42 h CET Salvatore Bonaccorso a écrit :
> The following vulnerability was published for cups.
> 
> CVE-2019-2228[0] (…)
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For the record, due to subkey expiration and rotation, I won't be able to 
upload before the next keyring-maint sync (around Dec 24). Feel free (you or 
anybody) to NMU as needed!

Cheers,

    OdyX

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.