News
Vigil@nce - CUPS: buffer overflow of texttopdf
August 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can generate a buffer overflow in texttopdf of CUPS,
in order to trigger a denial of service, and possibly to execute
code.
Impacted products: CUPS, Debian, Fedora, openSUSE, Ubuntu.
Severity: 2/4.
Creation date: 29/06/2015.
DESCRIPTION OF THE VULNERABILITY
The CUPS product includes a tool to convert raw text to PDF.
When generating the PDF header, in the function "WriteProlog", a
buffer size is computed from the number of lines and columns of
text. However, if the specified size is too small, an invalid
buffer size is used and an overflow will happen when generating
pages.
An attacker can therefore generate a buffer overflow in texttopdf
of CUPS, in order to trigger a denial of service, and possibly to
execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/CUPS-buffer-overflow-of-texttopdf-17249
