cups-2.3.3op2-4.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10707-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z cups-2.3.3op2-4.2 on GA media These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10707 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2005-3193/ SUSE CVE CVE-2005-3193 page https://www.suse.com/security/cve/CVE-2005-3624/ SUSE CVE CVE-2005-3624 page https://www.suse.com/security/cve/CVE-2005-3628/ SUSE CVE CVE-2005-3628 page https://www.suse.com/security/cve/CVE-2007-0104/ SUSE CVE CVE-2007-0104 page https://www.suse.com/security/cve/CVE-2007-3387/ SUSE CVE CVE-2007-3387 page https://www.suse.com/security/cve/CVE-2007-4351/ SUSE CVE CVE-2007-4351 page https://www.suse.com/security/cve/CVE-2007-4352/ SUSE CVE CVE-2007-4352 page https://www.suse.com/security/cve/CVE-2007-5393/ SUSE CVE CVE-2007-5393 page https://www.suse.com/security/cve/CVE-2008-0047/ SUSE CVE CVE-2008-0047 page https://www.suse.com/security/cve/CVE-2008-1693/ SUSE CVE CVE-2008-1693 page https://www.suse.com/security/cve/CVE-2008-1722/ SUSE CVE CVE-2008-1722 page https://www.suse.com/security/cve/CVE-2008-3641/ SUSE CVE CVE-2008-3641 page https://www.suse.com/security/cve/CVE-2017-18248/ SUSE CVE CVE-2017-18248 page https://www.suse.com/security/cve/CVE-2018-4700/ SUSE CVE CVE-2018-4700 page https://www.suse.com/security/cve/CVE-2019-2228/ SUSE CVE CVE-2019-2228 page https://www.suse.com/security/cve/CVE-2019-8696/ SUSE CVE CVE-2019-8696 page https://www.suse.com/security/cve/CVE-2019-8842/ SUSE CVE CVE-2019-8842 page https://www.suse.com/security/cve/CVE-2020-10001/ SUSE CVE CVE-2020-10001 page https://www.suse.com/security/cve/CVE-2020-3898/ SUSE CVE CVE-2020-3898 page https://www.suse.com/security/cve/CVE-2021-25317/ SUSE CVE CVE-2021-25317 page openSUSE Tumbleweed cups-2.3.3op2-4.2 cups-client-2.3.3op2-4.2 cups-config-2.3.3op2-4.2 cups-ddk-2.3.3op2-4.2 cups-devel-2.3.3op2-4.2 cups-devel-32bit-2.3.3op2-4.2 libcups2-2.3.3op2-4.2 libcups2-32bit-2.3.3op2-4.2 libcupsimage2-2.3.3op2-4.2 libcupsimage2-32bit-2.3.3op2-4.2 cups-2.3.3op2-4.2 as a component of openSUSE Tumbleweed cups-client-2.3.3op2-4.2 as a component of openSUSE Tumbleweed cups-config-2.3.3op2-4.2 as a component of openSUSE Tumbleweed cups-ddk-2.3.3op2-4.2 as a component of openSUSE Tumbleweed cups-devel-2.3.3op2-4.2 as a component of openSUSE Tumbleweed cups-devel-32bit-2.3.3op2-4.2 as a component of openSUSE Tumbleweed libcups2-2.3.3op2-4.2 as a component of openSUSE Tumbleweed libcups2-32bit-2.3.3op2-4.2 as a component of openSUSE Tumbleweed libcupsimage2-2.3.3op2-4.2 as a component of openSUSE Tumbleweed libcupsimage2-32bit-2.3.3op2-4.2 as a component of openSUSE Tumbleweed Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated. CVE-2005-3193 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2005-3193.html CVE-2005-3193 https://bugzilla.suse.com/137156 SUSE Bug 137156 https://bugzilla.suse.com/142106 SUSE Bug 142106 The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows. CVE-2005-3624 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2005-3624.html CVE-2005-3624 https://bugzilla.suse.com/137156 SUSE Bug 137156 https://bugzilla.suse.com/142106 SUSE Bug 142106 https://bugzilla.suse.com/291690 SUSE Bug 291690 Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors. CVE-2005-3628 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2005-3628.html CVE-2005-3628 https://bugzilla.suse.com/137156 SUSE Bug 137156 The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node. CVE-2007-0104 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-0104.html CVE-2007-0104 https://bugzilla.suse.com/233113 SUSE Bug 233113 https://bugzilla.suse.com/234492 SUSE Bug 234492 Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function. CVE-2007-3387 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-3387.html CVE-2007-3387 https://bugzilla.suse.com/291690 SUSE Bug 291690 https://bugzilla.suse.com/335637 SUSE Bug 335637 Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted (1) textWithLanguage or (2) nameWithLanguage Internet Printing Protocol (IPP) tag, leading to a stack-based buffer overflow. CVE-2007-4351 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-4351.html CVE-2007-4351 https://bugzilla.suse.com/335635 SUSE Bug 335635 Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file. CVE-2007-4352 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-4352.html CVE-2007-4352 https://bugzilla.suse.com/335637 SUSE Bug 335637 Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter. CVE-2007-5393 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-5393.html CVE-2007-5393 https://bugzilla.suse.com/335637 SUSE Bug 335637 Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions. CVE-2008-0047 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-0047.html CVE-2008-0047 https://bugzilla.suse.com/367225 SUSE Bug 367225 The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object. CVE-2008-1693 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-1693.html CVE-2008-1693 https://bugzilla.suse.com/377838 SUSE Bug 377838 https://bugzilla.suse.com/377872 SUSE Bug 377872 Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image. CVE-2008-1722 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-1722.html CVE-2008-1722 https://bugzilla.suse.com/378335 SUSE Bug 378335 https://bugzilla.suse.com/448631 SUSE Bug 448631 The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory. CVE-2008-3641 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-3641.html CVE-2008-3641 https://bugzilla.suse.com/430543 SUSE Bug 430543 The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification. CVE-2017-18248 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-18248.html CVE-2017-18248 https://bugzilla.suse.com/1087018 SUSE Bug 1087018 https://bugzilla.suse.com/1087072 SUSE Bug 1087072 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2018-4700 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-4700.html CVE-2018-4700 https://bugzilla.suse.com/1115750 SUSE Bug 1115750 https://bugzilla.suse.com/1131480 SUSE Bug 1131480 In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196 CVE-2019-2228 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-2228.html CVE-2019-2228 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code. CVE-2019-8696 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 important 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-8696.html CVE-2019-8696 https://bugzilla.suse.com/1146358 SUSE Bug 1146358 https://bugzilla.suse.com/1146359 SUSE Bug 1146359 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs. CVE-2019-8842 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-8842.html CVE-2019-8842 https://bugzilla.suse.com/1170671 SUSE Bug 1170671 An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory. CVE-2020-10001 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-10001.html CVE-2020-10001 https://bugzilla.suse.com/1170671 SUSE Bug 1170671 https://bugzilla.suse.com/1180520 SUSE Bug 1180520 A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges. CVE-2020-3898 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-3898.html CVE-2020-3898 https://bugzilla.suse.com/1168422 SUSE Bug 1168422 https://bugzilla.suse.com/1170671 SUSE Bug 1170671 A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions. CVE-2021-25317 openSUSE Tumbleweed:cups-2.3.3op2-4.2 openSUSE Tumbleweed:cups-client-2.3.3op2-4.2 openSUSE Tumbleweed:cups-config-2.3.3op2-4.2 openSUSE Tumbleweed:cups-ddk-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-2.3.3op2-4.2 openSUSE Tumbleweed:cups-devel-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-2.3.3op2-4.2 openSUSE Tumbleweed:libcups2-32bit-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-2.3.3op2-4.2 openSUSE Tumbleweed:libcupsimage2-32bit-2.3.3op2-4.2 low 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25317.html CVE-2021-25317 https://bugzilla.suse.com/1184161 SUSE Bug 1184161 https://bugzilla.suse.com/1192358 SUSE Bug 1192358