Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2004-1267 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Software Products Cups

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents9 sources
Severity
6.5MEDIUMNVD
EPSS
23.3%
top 4.04%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Apple CupsEasy Software Products CupsRedhat Fedora Core
Timeline
PublishedJan 10
Latest updateApr 29

Description

Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops program for CUPS 1.1.22 allows remote attackers to execute arbitrary code via a crafted HPGL file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages3 packages

▶Debianapple/cups< 1.1.22-2+3
▶NVDeasy_software_products/cups22 versions+21
▶NVDredhat/fedora_corecore_2.0, core_3.0+1

🔴Vulnerability Details

3
GHSA
GHSA-3352-53wf-rvq5: Buffer overflow in the ParseCommand function in hpgl-input↗2022-04-29
▶
OSV
CVE-2004-1267: Buffer overflow in the ParseCommand function in hpgl-input↗2005-01-10
▶
CVEList
CVE-2004-1267: Buffer overflow in the ParseCommand function in hpgl-input↗2004-12-22
▶

💥Exploits & PoCs

1
Exploit-DB
CUPS 1.1.x - '.HPGL' File Processor Buffer Overflow↗2004-12-15
▶

📋Vendor Advisories

3
Ubuntu
CUPS vulnerabilities↗2004-12-23
▶
Red Hat
security flaw↗2004-12-15
▶
Debian
CVE-2004-1267: cups - Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops pro...↗2004
▶

💬Community

1
Bugzilla
CVE-2004-1267 security flaw↗2018-08-16
▶
CVE-2004-1267 — Software Products Cups vulnerability | cvebase