sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2023-32324 OpenPrinting CUPS vulnerable to heap buffer overflow

High 7.5 Published Updated

Remote attackers can cause denial of service in CUPS via heap buffer overflow when debug logging is enabled.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2023-32324?

CVE-2023-32324 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 1 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2023-32324?

It affects 2 products.

Linux distribution packages (36)
cups SUSE:Enterprise Storage 7All versions2.2.7-150000.3.43.1
cups SUSE:Enterprise Storage 7.1All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Micro 5.2All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Micro 5.3All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Micro 5.4All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Module for Basesystem 15 SP4All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Module for Basesystem 15 SP5All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Module for Desktop Applications 15 SP5All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Module for Development Tools 15 SP4All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Module for Development Tools 15 SP5All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Real Time 15 SP3All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Server 12 SP2-BCLAll versions1.7.5-20.39.1
cups SUSE:Linux Enterprise Server 12 SP4-ESPOSAll versions1.7.5-20.39.1
cups SUSE:Linux Enterprise Server 12 SP4-LTSSAll versions1.7.5-20.39.1
cups SUSE:Linux Enterprise Server 12 SP5All versions1.7.5-20.39.1
cups SUSE:Linux Enterprise Server 15 SP1-LTSSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Server 15 SP2-LTSSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Server 15 SP3-LTSSAll versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Server for SAP Applications 12 SP4All versions1.7.5-20.39.1
cups SUSE:Linux Enterprise Server for SAP Applications 12 SP5All versions1.7.5-20.39.1
cups SUSE:Linux Enterprise Server for SAP Applications 15 SP1All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Server for SAP Applications 15 SP2All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Server for SAP Applications 15 SP3All versions2.2.7-150000.3.43.1
cups SUSE:Linux Enterprise Software Development Kit 12 SP5All versions1.7.5-20.39.1
cups SUSE:Manager Proxy 4.2All versions2.2.7-150000.3.43.1
cups SUSE:Manager Server 4.2All versions2.2.7-150000.3.43.1
cups SUSE:OpenStack Cloud 9All versions1.7.5-20.39.1
cups SUSE:OpenStack Cloud Crowbar 9All versions1.7.5-20.39.1
cups openSUSE:Leap 15.4All versions2.2.7-150000.3.43.1
cups openSUSE:Leap 15.5All versions2.2.7-150000.3.43.1
cups openSUSE:Leap Micro 5.3All versions2.2.7-150000.3.43.1
cups openSUSE:TumbleweedAll versions2.4.2-5.1

Products include Debian Debian Linux, Openprinting Cups.

How do I fix CVE-2023-32324?

No fix published yet.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-32324 being exploited?

There is no known exploitation of CVE-2023-32324 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2023-32324, AZL-37073, AZL-37098, CLSA-2023-1689009273, CLSA-2024-1733420952, DEBIAN-CVE-2023-32324 and 10 more.

Is CVE-2023-32324 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free