CVE-2015-3279: Buffer Overflow
An integer overflow flaw leading to a heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code with the privileges of the 'lp' user.
Patch: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365
Other sources
Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3279?
CVE-2015-3279 has been classified with a high severity rating due to its potential to cause crashes and possibly execute arbitrary code.
How do I fix CVE-2015-3279?
To fix CVE-2015-3279, update the cups-filters package to version 1.0.71 or higher.
Which software versions are affected by CVE-2015-3279?
Affected software includes cups-filters versions up to 1.0.70 and various versions of Ubuntu and Debian Linux.
What types of attacks can exploit CVE-2015-3279?
An attacker can exploit CVE-2015-3279 by submitting specially crafted print jobs that trigger an integer overflow leading to a heap-based buffer overflow.
Is CVE-2015-3279 a local or remote vulnerability?
CVE-2015-3279 is considered a local vulnerability as it requires the attacker to have the ability to submit print jobs.