CVE-2015-3258: Buffer Overflow
A heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filters processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code with the privileges of the 'lp' user.
Acknowledgements:
This issue was discovered by Petr Sklenar of Red Hat.
Other sources
Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3258?
CVE-2015-3258 is considered to have a medium severity rating due to its potential to allow an attacker to execute arbitrary code.
How do I fix CVE-2015-3258?
To fix CVE-2015-3258, upgrade the cups-filters package to the latest version that is not vulnerable.
Which platforms are affected by CVE-2015-3258?
CVE-2015-3258 affects various versions of Ubuntu Linux and Debian, specifically versions 12.04, 14.04, 14.10, 15.04, and 7.1, 8.0 respectively.
What kind of exploit can be executed with CVE-2015-3258?
An attacker can exploit CVE-2015-3258 by submitting specially crafted print jobs to crash the texttopdf utility or potentially execute code with elevated privileges.
What component is vulnerable in CVE-2015-3258?
The vulnerability in CVE-2015-3258 lies in the way the texttopdf utility processes print jobs in the cups-filters package.