rpms/cups
6
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS

Browse Source 
Resolves: RHEL-113078
This commit is contained in:
Zdenek Dohnal 2025-09-11 14:34:12 +02:00
parent 707aa91a75
commit 5e93223eeb
2 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
CVE-2025-58364.patch Normal file
View File

@ -0,0 +1,46 @@
diff -up cups-2.3.3op2/cups/ipp.c.cve-2025-58364 cups-2.3.3op2/cups/ipp.c
--- cups-2.3.3op2/cups/ipp.c.cve-2025-58364 2025-09-05 07:36:47.894411883 +0200
+++ cups-2.3.3op2/cups/ipp.c 2025-09-05 08:16:20.667587236 +0200
@@ -2951,34 +2951,6 @@ ippReadIO(void *src, /* I - Data
*/
tag = (ipp_tag_t)buffer[0];
- if (tag == IPP_TAG_EXTENSION)
- {
- /*
- * Read 32-bit "extension" tag...
- */
-
- if ((*cb)(src, buffer, 4) < 4)
- {
- DEBUG_puts("1ippReadIO: Callback returned EOF/error");
- _cupsBufferRelease((char *)buffer);
- return (IPP_STATE_ERROR);
- }
-
- tag = (ipp_tag_t)((((((buffer[0] << 8) | buffer[1]) << 8) |
- buffer[2]) << 8) | buffer[3]);
-
- if (tag & IPP_TAG_CUPS_CONST)
- {
- /*
- * Fail if the high bit is set in the tag...
- */
-
- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag));
- _cupsBufferRelease((char *)buffer);
- return (IPP_STATE_ERROR);
- }
- }
if (tag == IPP_TAG_END)
{
@@ -3199,6 +3171,7 @@ ippReadIO(void *src, /* I - Data
if ((*cb)(src, buffer, (size_t)n) < n)
{
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1);
DEBUG_puts("1ippReadIO: unable to read name.");
_cupsBufferRelease((char *)buffer);
return (IPP_STATE_ERROR);

5
cups.spec
View File

@ -163,6 +163,8 @@ Patch50: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch
Patch51: 0001-Add-NoSystem-SSLOptions-value.patch
# RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
Patch52: CVE-2025-58060.patch
# RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
Patch53: CVE-2025-58364.patch
##### Patches removed because IMHO they aren't no longer needed
@ -452,6 +454,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
%patch51 -p1 -b .ssl-nosystem
# RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
%patch52 -p1 -b .cve-2025-58060
# RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
%patch53 -p1 -b .cve-2025-58364
%if %{lspp}
@ -919,6 +923,7 @@ rm -f %{cups_serverbin}/backend/smb
%changelog
* Thu Sep 11 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-34
- RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
- RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
* Wed Jan 08 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-33
- Add NoSystem SSLOptions value