CVE-2013-6475: Buffer Overflow
Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow.
Other sources
Previously, the pdftoopvp filter used gmalloc for memory allocations. This could result in integer overflow flaws, leading to heap-based buffer overflows. If a malicious PDF file were processed, it could lead to arbitrary code execution with the privileges of the "lp" user. The following patch introduces the use of gmallocn and gmallocn3, which attempt to check for integer overflows:
http://cgit.freedesktop.org/poppler/poppler/commit/?id=7b2d314a61fd0e12f47c62996cb49ec0d1ba747a
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cupsto a version that resolves this vulnerability.Fixed in 2.3.3op2-3+deb11u8Fixed in 2.3.3op2-3+deb11u9Fixed in 2.4.2-3+deb12u8Fixed in 2.4.10-2 - Upgrade
Upgrade
debian/cups-filtersto a version that resolves this vulnerability.Fixed in 1.28.7-1+deb11u2Fixed in 1.28.7-1+deb11u3Fixed in 1.28.17-3+deb12u1Fixed in 1.28.17-6 - Upgrade
Upgrade
cups-filters/pdftoopvp filterto a version that resolves this vulnerability.Fixed in 1.0.47
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6475?
CVE-2013-6475 has a high severity due to its potential to allow remote attackers to execute arbitrary code via crafted PDF files.
How do I fix CVE-2013-6475?
To fix CVE-2013-6475, you should upgrade to the latest versions of cups or cups-filters that are patched for this vulnerability.
What software is affected by CVE-2013-6475?
CVE-2013-6475 affects versions of cups and cups-filters prior to 1.0.47.
Can CVE-2013-6475 be exploited remotely?
Yes, CVE-2013-6475 can be exploited remotely through specially crafted PDF files.
What type of vulnerability is CVE-2013-6475?
CVE-2013-6475 is classified as an integer overflow vulnerability leading to a heap-based buffer overflow.