Description
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =2.4.10-1 || =2.4.10-2 || =2.4.10-3 || =2.4.10-4 || =2.4.14-1 || =2.4.15-1 || =2.4.16-1 || =2.4.17-1 || =2.4.18-1 || =2.4.2-3 || =2.4.2-3+deb12u1 || =2.4.2-3+deb12u2 || =2.4.2-3+deb12u3 || =2.4.2-3+deb12u4 || =2.4.2-3+deb12u5 || =2.4.2-3+deb12u6 || =2.4.2-3+deb12u7 || =2.4.2-3+deb12u8 || =2.4.2-3+deb12u9 || =2.4.2-4 || =2.4.2-5 || =2.4.2-6 || =2.4.7-1 || =2.4.7-1.1 || =2.4.7-1.2 || =2.4.7-2 || =2.4.7-3 |
debian 13 | | =2.4.10-3 || =2.4.10-3+deb13u1 || =2.4.10-3+deb13u2 || =2.4.10-4 || =2.4.14-1 || =2.4.15-1 || =2.4.16-1 || =2.4.17-1 || =2.4.18-1 |
debian 14 | | =2.4.10-3 || =2.4.10-4 || =2.4.14-1 || =2.4.15-1 || =2.4.16-1 || =2.4.17-1 || =2.4.18-1 |
 rpm rhel6 | | - |
rpm rhel10 | | - |
rpm rhel7 | | - |
rpm rhel8 | | - |
rpm rhel9 | | - |
