CVE-2023-4504 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
Attackers can execute arbitrary code via heap overflow in CUPS/libppd by sending crafted PPD PostScript documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-4504?
CVE-2023-4504 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 21 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.
Which versions are affected by CVE-2023-4504?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Openprinting Cups, Openprinting Libppd.
How do I fix CVE-2023-4504?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-4504 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4504 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2023-4504, AZL-37075, AZL-37100, BELL-CVE-2023-4504, CLSA-2023-1697575950, CLSA-2023-1697576053 and 14 more.