CVE-2023-34241
published 2023-06-22CVE-2023-34241: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to…
PriorityP434high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
1.38%
69.1th percentile
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.
The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.
Version 2.4.6 has a patch for this issue.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | >= 0 < 2.3.3-r8 | 2.3.3-r8 |
| apple | cups | >= 0 < 2.4.2-r2 | 2.4.2-r2 |
| apple | cups | >= 0 < 2.4.2-r3 | 2.4.2-r3 |
| apple | cups | >= 0 < 2.3.3op2-3+deb11u3 | 2.3.3op2-3+deb11u3 |
| apple | cups | >= 0 < 2.4.2-3+deb12u1 | 2.4.2-3+deb12u1 |
| apple | cups | >= 0 < 2.4.2-5 | 2.4.2-5 |
| apple | cups | >= 0 < 2.4.2-5 | 2.4.2-5 |
| apple | macos | < 11.7.9 | 11.7.9 |
| apple | macos | >= 12.0.0 < 12.6.8 | 12.6.8 |
| apple | macos | >= 13.0 < 13.5 | 13.5 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | macos_ventura | — | — |
| debian | cups | < cups 2.4.2-3+deb12u1 (bookworm) | cups 2.4.2-3+deb12u1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_cups_2.3.3op2-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_cups_2.4.10-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_cups_2.3.3op2-7_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_cups_2.3.3op2-9_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_msrc7.1HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2023-34241: macOS Monterey 12.6.8
vendor_apple·2023-07-24·CVSS 5.3
CVE-2023-34241 [MEDIUM] CVE-2023-34241: macOS Monterey 12.6.8
Apple Security Update: About the security content of macOS Monterey 12.6.8
Product: macOS Monterey
Version: 12.6.8
CVE: CVE-2023-34241
Component: CUPS
Impact: A user in a privileged network position may be able to leak sensitive information
Description: A logic issue was addressed with improved state management.
Apple
CVE-2023-34241: macOS Ventura 13.5
vendor_apple·2023-07-24·CVSS 5.3
CVE-2023-34241 [MEDIUM] CVE-2023-34241: macOS Ventura 13.5
Apple Security Update: About the security content of macOS Ventura 13.5
Product: macOS Ventura
Version: 13.5
CVE: CVE-2023-34241
Component: CUPS
Impact: A user in a privileged network position may be able to leak sensitive information
Description: A logic issue was addressed with improved state management.
Apple
CVE-2023-34241: macOS Big Sur 11.7.9
vendor_apple·2023-07-24·CVSS 5.3
CVE-2023-34241 [MEDIUM] CVE-2023-34241: macOS Big Sur 11.7.9
Apple Security Update: About the security content of macOS Big Sur 11.7.9
Product: macOS Big Sur
Version: 11.7.9
CVE: CVE-2023-34241
Component: CUPS
Impact: A user in a privileged network position may be able to leak sensitive information
Description: A logic issue was addressed with improved state management.
Ubuntu
CUPS vulnerability
vendor_ubuntu·2023-07-17
CVE-2023-34241 CUPS vulnerability
Title: CUPS vulnerability
Summary: CUPS could be made to crash or expose sensitive information over the network.
USN-6184-1 fixed a vulnerability in CUPS. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that CUPS incorrectly handled certain memory operations.
An attacker could possibly use this issue to cause CUPS to crash, resulting
in a denial of service, or to possibly obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
cups: use-after-free in cupsdAcceptClient() in scheduler/client.c
vendor_redhat·2023-06-22·CVSS 5.3
CVE-2023-34241 [MEDIUM] CWE-416 cups: use-after-free in cupsdAcceptClient() in scheduler/client.c
cups: use-after-free in cupsdAcceptClient() in scheduler/client.c
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.
The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is w
Ubuntu
CUPS vulnerability
vendor_ubuntu·2023-06-22
CVE-2023-34241 CUPS vulnerability
Title: CUPS vulnerability
Summary: CUPS could be made to crash or expose sensitive information over the
network.
It was discovered that CUPS incorrectly handled certain memory operations.
An attacker could possibly use this issue to cause CUPS to crash, resulting
in a denial of service, or possibly obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
CUPS vulnerable to use-after-free in cupsdAcceptClient()
vendor_msrc·2023-06-13·CVSS 7.1
CVE-2023-34241 [MEDIUM] CWE-416 CUPS vulnerable to use-after-free in cupsdAcceptClient()
CUPS vulnerable to use-after-free in cupsdAcceptClient()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:
Debian
CVE-2023-34241: cups - OpenPrinting CUPS is a standards-based, open source printing system for Linux an...
vendor_debian·2023·CVSS 5.3
CVE-2023-34241 [MEDIUM] CVE-2023-34241: cups - OpenPrinting CUPS is a standards-based, open source printing system for Linux an...
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for th
OSV
CVE-2023-34241: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems
osv·2023-06-22·CVSS 7.1
CVE-2023-34241 [HIGH] CVE-2023-34241: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for th
OSV
CVE-2023-34241: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems
osv·2023-06-22·CVSS 7.1
CVE-2023-34241 [HIGH] CVE-2023-34241: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.
The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/06/23/10http://www.openwall.com/lists/oss-security/2023/06/26/1https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2https://github.com/OpenPrinting/cups/releases/tag/v2.4.6https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25https://lists.debian.org/debian-lts-announce/2023/06/msg00038.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/7I7DWGYGEMBNLZF5UQBMF3SONR37YUBN/https://lists.fedoraproject.org/archives/list/[email protected]/message/TBIYKDS3UG3W4Z7YOHTR2AWFNBRYPNYY/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845http://www.openwall.com/lists/oss-security/2023/06/23/10http://www.openwall.com/lists/oss-security/2023/06/26/1https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2https://github.com/OpenPrinting/cups/releases/tag/v2.4.6https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25https://lists.debian.org/debian-lts-announce/2023/06/msg00038.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/7I7DWGYGEMBNLZF5UQBMF3SONR37YUBN/https://lists.fedoraproject.org/archives/list/[email protected]/message/TBIYKDS3UG3W4Z7YOHTR2AWFNBRYPNYY/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845
2023-06-22
Published