CVE-2019-2228

NameCVE-2019-2228
DescriptionIn array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2047-1
Debian Bugs946782

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)buster, buster (security)2.2.10-6+deb10u6fixed
bullseye (security), bullseye2.3.3op2-3+deb11u2fixed
bookworm, sid2.4.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssourcejessie1.7.5-11+deb8u7DLA-2047-1
cupssourcestretch2.2.1-8+deb9u5
cupssourcebuster2.2.10-6+deb10u2
cupssource(unstable)2.3.1-1946782

Notes

https://github.com/apple/cups/commit/b018978c278d42c7abf78941251b887c95dfdb07 (master, v2.3.1)
https://github.com/apple/cups/commit/8c9b3606cca99e5dfc51784a9de1634345db7579 (v2.2.13)
Search for package or bug name: Reporting problems