From 5e93223eeb5f9339dc10c46a5eab714a4fd2d96b Mon Sep 17 00:00:00 2001 From: Zdenek Dohnal Date: Thu, 11 Sep 2025 14:34:12 +0200 Subject: [PATCH] RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS Resolves: RHEL-113078 --- CVE-2025-58364.patch | 46 ++++++++++++++++++++++++++++++++++++++++++++ cups.spec | 5 +++++ 2 files changed, 51 insertions(+) create mode 100644 CVE-2025-58364.patch diff --git a/CVE-2025-58364.patch b/CVE-2025-58364.patch new file mode 100644 index 0000000..68796a9 --- /dev/null +++ b/CVE-2025-58364.patch @@ -0,0 +1,46 @@ +diff -up cups-2.3.3op2/cups/ipp.c.cve-2025-58364 cups-2.3.3op2/cups/ipp.c +--- cups-2.3.3op2/cups/ipp.c.cve-2025-58364 2025-09-05 07:36:47.894411883 +0200 ++++ cups-2.3.3op2/cups/ipp.c 2025-09-05 08:16:20.667587236 +0200 +@@ -2951,34 +2951,6 @@ ippReadIO(void *src, /* I - Data + */ + + tag = (ipp_tag_t)buffer[0]; +- if (tag == IPP_TAG_EXTENSION) +- { +- /* +- * Read 32-bit "extension" tag... +- */ +- +- if ((*cb)(src, buffer, 4) < 4) +- { +- DEBUG_puts("1ippReadIO: Callback returned EOF/error"); +- _cupsBufferRelease((char *)buffer); +- return (IPP_STATE_ERROR); +- } +- +- tag = (ipp_tag_t)((((((buffer[0] << 8) | buffer[1]) << 8) | +- buffer[2]) << 8) | buffer[3]); +- +- if (tag & IPP_TAG_CUPS_CONST) +- { +- /* +- * Fail if the high bit is set in the tag... +- */ +- +- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1); +- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag)); +- _cupsBufferRelease((char *)buffer); +- return (IPP_STATE_ERROR); +- } +- } + + if (tag == IPP_TAG_END) + { +@@ -3199,6 +3171,7 @@ ippReadIO(void *src, /* I - Data + + if ((*cb)(src, buffer, (size_t)n) < n) + { ++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1); + DEBUG_puts("1ippReadIO: unable to read name."); + _cupsBufferRelease((char *)buffer); + return (IPP_STATE_ERROR); diff --git a/cups.spec b/cups.spec index 749397d..ef8c70f 100644 --- a/cups.spec +++ b/cups.spec @@ -163,6 +163,8 @@ Patch50: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch Patch51: 0001-Add-NoSystem-SSLOptions-value.patch # RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling Patch52: CVE-2025-58060.patch +# RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS +Patch53: CVE-2025-58364.patch ##### Patches removed because IMHO they aren't no longer needed @@ -452,6 +454,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in %patch51 -p1 -b .ssl-nosystem # RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling %patch52 -p1 -b .cve-2025-58060 +# RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS +%patch53 -p1 -b .cve-2025-58364 %if %{lspp} @@ -919,6 +923,7 @@ rm -f %{cups_serverbin}/backend/smb %changelog * Thu Sep 11 2025 Zdenek Dohnal - 1.2.3.3op2-34 - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling +- RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS * Wed Jan 08 2025 Zdenek Dohnal - 1:2.3.3op2-33 - Add NoSystem SSLOptions value