Bug#1120697: libcupsfilters: CVE-2025-64503
Source: libcupsfilters
Version: 2.0.0-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: clone -1 -2
Control: reassign -2 src:cups-filters 1.28.17-6
Control: retitle -2 cups-filters: CVE-2025-64503
Control: found -2 1.28.17-3+deb12u1
Hi,
The following vulnerability was published for
libcupsfilters/cups-filters.
CVE-2025-64503[0]:
| cups-filters contains backends, filters, and other software required
| to get the cups printing service working on operating systems other
| than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
| with a large `MediaBox` value, an attacker can cause CUPS-Filter
| 1.x’s `pdftoraster` tool to write beyond the bounds of an array.
| First, a PDF with a large `MediaBox` width value causes
| `header.cupsWidth` to become large. Next, the calculation of
| `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) /
| 8` overflows, resulting in a small value. Then, `lineBuf` is
| allocated with the small `bytesPerLine` size. Finally,
| `convertLineChunked` calls `writePixel8`, which attempts to write to
| `lineBuf` outside of its buffer size (out of bounds write). In
| libcupsfilters, the maintainers found the same `bytesPerLine`
| multiplication without overflow check, but the provided test case
| does not cause an overflow there, because the values are different.
| Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch,
| which is incorporated into cups-filters version 1.28.18.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-64503
https://www.cve.org/CVERecord?id=CVE-2025-64503
[1] https://www.openwall.com/lists/oss-security/2025/11/12/2
[2] https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-893j-2wr2-wrh9
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Reply to: