CVE-2023-34095: cpdb-libs vulnerable to buffer overflows via scanf
cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of scanf(3). cpdb-libs uses the fscanf() and scanf() functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by fscanf() and scanf() causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of %s with %1023s in all calls of the fscanf() and scanf() functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cpdb-libsto a version that resolves this vulnerability.Patch f181bd1f14757c2ae0f17cc76dc20421a40f30b7 - Configuration
Implement the patch behavior by updating every `fscanf()`/`scanf()` call that uses `%s` so it uses `%1023s` instead, preventing reads longer than 1023 characters into 1024-length buffers (affected in versions 1.0 through 2.0b4).
cpdb-libs scanf()/fscanf() format strings = Replace all occurrences of `%s` with `%1023s` in calls to `scanf()` and `fscanf()` to limit maximum string length to 1023 characters (for 1024-byte buffers)
Event History
Frequently Asked Questions
What is CVE-2023-34095?
CVE-2023-34095 is a vulnerability in cpdb-libs, which is the frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project.
What is the severity of CVE-2023-34095?
CVE-2023-34095 has a severity rating of 9.8 (Critical).
How does CVE-2023-34095 work?
CVE-2023-34095 is a buffer overflow vulnerability that occurs due to improper use of `scanf(3)` in cpdb-libs.
Which versions of cpdb-libs are affected by CVE-2023-34095?
Versions 1.0 through 2.0b4 of cpdb-libs are affected by CVE-2023-34095.
How can I fix CVE-2023-34095?
To fix CVE-2023-34095, it is recommended to update cpdb-libs to a version that is not affected by the vulnerability.