CVE-2013-6473: Buffer Overflow
Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large (1) page or (2) line in a URF file.
Other sources
Two heap-based buffer overflow flaws were found in the urftopdf filter. If a malicious URF file were processed, it could lead to arbitrary code execution with the privileges of the "lp" user.
Acknowledgements:
These issues were discovered by Florian Weimer of the Red Hat Product Security Team.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cups-filtersto a version that resolves this vulnerability.Fixed in 1.28.7-1+deb11u2Fixed in 1.28.7-1+deb11u3Fixed in 1.28.17-3+deb12u1Fixed in 1.28.17-6
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6473?
CVE-2013-6473 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2013-6473?
To fix CVE-2013-6473, upgrade cups-filters to version 1.0.47 or later.
What types of attacks can exploit CVE-2013-6473?
CVE-2013-6473 can be exploited by attacking through specially crafted URF files that trigger heap-based buffer overflows.
Which versions of cups-filters are affected by CVE-2013-6473?
CVE-2013-6473 affects versions of cups-filters prior to 1.0.47.
What is the impact of exploiting CVE-2013-6473?
Exploiting CVE-2013-6473 can lead to arbitrary code execution on affected systems.