cpdb-libs vulnerable to buffer overflows via scanf
CVE-2023-34095

9.8CRITICAL

Key Information:

Vendor
Openprinting
Status
Cpdb-libs
Vendor
CVE Published:
14 June 2023

Summary

The cpdb-libs library for Common Printing Dialog Backends contains a buffer overflow vulnerability due to improper handling of input strings in scanf and fscanf functions. Boundless input lengths can lead to overruns, making it crucial to restrict maximum read lengths to prevent exploitation. A patch has been implemented to cap string lengths to 1023 characters, thus safeguarding fixed-length buffers. Users should upgrade to the latest version to mitigate this risk and ensure secure operations.

Affected Version(s)

cpdb-libs >= 1.0, <= 2.0b4

References

https://github.com/OpenPrinting/cpdb-libs/security/adviso...
x_refsource_CONFIRM
https://github.com/OpenPrinting/cpdb-libs/commit/f181bd1f...
x_refsource_MISC
https://github.com/OpenPrinting/cpdb-libs/blob/85555fba64...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-34095 : cpdb-libs vulnerable to buffer overflows via scanf | SecurityVulnerability.io