mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 13:18:36 -09:00
def2405f39
This fixes the following vulnerability:
- CVE-2025-64503:
cups-filters contains backends, filters, and other software required
to get the cups printing service working on operating systems other
than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
`pdftoraster` tool to write beyond the bounds of an array. First, a
PDF with a large `MediaBox` width value causes `header.cupsWidth` to
become large. Next, the calculation of `bytesPerLine =
(header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
resulting in a small value. Then, `lineBuf` is allocated with the
small `bytesPerLine` size. Finally, `convertLineChunked` calls
`writePixel8`, which attempts to write to `lineBuf` outside of its
buffer size (out of bounds write). In libcupsfilters, the maintainers
found the same `bytesPerLine` multiplication without overflow check,
but the provided test case does not cause an overflow there, because
the values are different. Commit
50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
incorporated into cups-filters version 1.28.18.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64503
- 50d94ca0f2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>