CVE-2019-2228

NameCVE-2019-2228
DescriptionIn array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2047-1
NVD severitymedium
Debian Bugs946782

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)stretch2.2.1-8+deb9u5fixed
stretch (security)2.2.1-8+deb9u2vulnerable
buster2.2.10-6+deb10u3fixed
bullseye, sid2.3.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssource(unstable)2.3.1-1946782
cupssourcebuster2.2.10-6+deb10u2
cupssourcejessie1.7.5-11+deb8u7DLA-2047-1
cupssourcestretch2.2.1-8+deb9u5

Notes

https://github.com/apple/cups/commit/b018978c278d42c7abf78941251b887c95dfdb07 (master, v2.3.1)
https://github.com/apple/cups/commit/8c9b3606cca99e5dfc51784a9de1634345db7579 (v2.2.13)

Search for package or bug name: Reporting problems