A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4469 advisory.

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated privileges. (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:4469 advisory.

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated privileges. (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has cups packages installed that are affected by a vulnerability:

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated privileges. (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2020:14341-1 advisory.

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated privileges. (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In macOS High Sierra before 10.13.5, an issue existed     in CUPS. This issue was addressed with improved access     restrictions.(CVE-2018-4180)

  - In macOS High Sierra before 10.13.5, an issue existed     in CUPS. This issue was addressed with improved access     restrictions.(CVE-2018-4181)

  - A memory corruption issue was addressed with improved     validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated     privileges.(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - This update for cups fixes the following issues: -     CVE-2020-3898: Fixed a heap buffer overflow in     ppdFindOption() (bsc#1168422).(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow was discovered in in     libcups's ppdFindOption() function in ppd-mark.c:430.
    The issue can be reproduced by loading a crafted ppd     file and calling the ppdMarkDefaults() libcups API     function.(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4469 advisory.

  - cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4469 advisory.

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated privileges. (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the cups packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - heap based buffer overflow in libcups's ppdFindOption()     in ppd-mark.c(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4469 advisory.

  - cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c (CVE-2020-3898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A memory corruption issue was addressed with improved     validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated     privileges.(CVE-2020-3898)

  - A buffer overflow issue was addressed with improved     memory handling. This issue is fixed in macOS Mojave     10.14.6, Security Update 2019-004 High Sierra, Security     Update 2019-004 Sierra. An attacker in a privileged     network position may be able to execute arbitrary     code.(CVE-2019-8675)

  - A buffer overflow issue was addressed with improved     memory handling. This issue is fixed in macOS Mojave     10.14.6, Security Update 2019-004 High Sierra, Security     Update 2019-004 Sierra. An attacker in a privileged     network position may be able to execute arbitrary     code.(CVE-2019-8696)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A memory corruption issue was addressed with improved     validation. This issue is fixed in macOS Catalina     10.15.4. An application may be able to gain elevated     privileges.(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - heap based buffer overflow in libcups's ppdFindOption()     in ppd-mark.c(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cups package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - There is a buffer error vulnerability in Apple cups.
    The vulnerability is due to the improper verification     of data boundaries when network systems or products     perform operations on memory, resulting in incorrect     read and write operations to other associated memory     locations. Attackers can use this vulnerability to     cause buffer overflow or heap overflow.(CVE-2020-3898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apple reports :

- CVE-2019-8842: The ippReadIO function may under-read an extension.

- CVE-2020-3898: The ppdOpen function did not handle invalid UI constraint. ppdcSource::get_resolution function did not handle invalid resolution strings. An application may be able to gain elevated privileges.

The following CVE(s) were reported against src:cups.

CVE-2019-8842

The `ippReadIO` function may under-read an extension field.

CVE-2020-3898

There was a heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c. The `ppdOpen` function did not handle invalid UI constraint. `ppdcSource::get_resolution` function did not handle invalid resolution strings.

For Debian 8 'Jessie', these problems have been fixed in version 1.7.5-11+deb8u8.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-3898

----

1822154 - cups.service doesn't execute automatically on request

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that CUPS incorrectly handled certain language values. A local attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or possibly obtain sensitive information. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-2228)

Stephan Zeisberg discovered that CUPS incorrectly handled certain malformed ppd files. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2020-3898).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cups fixes the following issues :

  - CVE-2020-3898: Fixed a heap buffer overflow in     ppdFindOption() (bsc#1168422).

This update was imported from the SUSE:SLE-15:Update update project.

This update for cups fixes the following issues :

CVE-2020-3898: Fixed a heap buffer overflow in ppdFindOption() (bsc#1168422).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2020-002, 10.14.x prior to 10.14.6 Security Update 2020-002, or 10.15.x prior to 10.15.4. It is, therefore, affected by multiple vulnerabilities :

  - Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor     Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
    (CVE-2019-14615)

  - ** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can     impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.
    NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo     as a user not present in the local password database is an intentional feature. Because this behavior     surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default     being disabled. However, this does not change the fact that sudo was behaving as intended, and as     documented, in earlier versions. (CVE-2019-19232)

  - An out-of-bounds read error exists in Bluetooth due to improper input sanitization. An attacker can     exploit this to read restricted memory. (CVE-2019-8853)

  - Privilege escalation vulnerabilities exist in IOThunderboltFamily (due to a use-after-free flaw), and in     CUPS (due to a memory corruption issue). An attacker can exploit this to gain elevated access to the     system. (CVE-2020-3851, CVE-2020-3898)

  - An information disclosure vulnerability exists in FaceTime, Icons, and Call History. An unauthenticated,     local attacker can exploit this, via malicious applications, to disclose potentially sensitive     information. (CVE-2020-3881, CVE-2020-9773, CVE-2020-9776)

  - An information disclosure vulnerability exists in Sandbox. A local user can exploit this to view     sensitvie user information. (CVE-2020-3918)

  - An unspecified issue exists in AppleMobileFileIntegrity due to an unspecified reason. An attacker can     exploit this to use arbitrary entitlements. (CVE-2020-3883)

  - An arbitrary code execution vulnerability exists in Mail due to improper input validation. An     unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary     JavaScript code. (CVE-2020-3884)

  - An arbitrary file read vulnerability exists in Time Machine due to improper state management. An     unauthenticated, local attacker can exploit this to read arbitrary files and disclose sensitive     information. (CVE-2020-3889)

  - An arbitrary code execution vulnerability exists in AppleGraphicsControl, Bluetooth, IOHIDFamily, and the     kernel due to memory initialization and corruption issues. An attacker can exploit this to bypass     authentication and execute arbitrary commands with kernel privileges. (CVE-2020-3892, CVE-2020-3893,     CVE-2020-3904, CVE-2020-3905, CVE-2020-3919, CVE-2020-9785)

  - An arbitrary code execution vulnerability exists in Apple HSSPI Support due to a memory corruption issue.
    An attacker can exploit this to bypass authentication and execute arbitrary commands with system     privileges. (CVE-2020-3903)

  - A logic issue exists in TCC due to an unspecified reason. An attacker can exploit this, via a maliciously     crafted application, to cause bypass code signing. (CVE-2020-3906)

  - An out-of-bounds read error exists in Bluetooth due to improper input validation. An unauthenticated local     attacker can exploit this to cause a denial of service or read kernel memory. (CVE-2020-3907,     CVE-2020-3908, CVE-2020-3912)

  - A buffer overflow condition exists in libxml2 due to improper bounds checking and size validation. An     attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.
    (CVE-2020-3909, CVE-2020-3910, CVE-2020-3911)

  - A privilege escalation vulnerability exists in due to improper permission validation. An unauthenticated,     remote attacker can exploit this, to gain elevated access to the system. (CVE-2020-3913)

  - An information disclosure vulnerability exists in the kernel due to improper memory handling. An attacker     can exploit this to read restricted memory. (CVE-2020-3914)

  - An arbitrary file overwrite vulnerability exists in Printing due improper path handlng. An attacker can     exploit this to overwrite arbitrary files. (CVE-2020-3915)

  - Multiple unspecified issues exist in the Vim installation on macOS. An attacker can exploit this to cause     an unknown impact. (CVE-2020-9769)

  - An unspecified vulnerability exists in sysdiagnose due to insufficient validation of user supplied input.     An attacker could exploit this issue with partial impact on the confidentiality, integrity & availability     of the application and/or system. (CVE-2020-9786)

  - An vulnerability exists in WebKit due to a logic flaw in restrictions. An attacker may exploit this flaw,     as part of a more elaborate attack, to gain unauthorized access to the MacOS camera. (CVE-2020-9787)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Severity
185028	Rocky Linux 8 : cups (RLSA-2020:4469)	Nessus	Rocky Linux Local Security Checks	high
157672	AlmaLinux 8 : cups (ALSA-2020:4469)	Nessus	Alma Linux Local Security Checks	high
154535	NewStart CGSL MAIN 6.02 : cups Vulnerability (NS-SA-2021-0124)	Nessus	NewStart CGSL Local Security Checks	high
150583	SUSE SLES11 Security Update : cups (SUSE-SU-2020:14341-1)	Nessus	SuSE Local Security Checks	high
149197	EulerOS 2.0 SP3 : cups (EulerOS-SA-2021-1773)	Nessus	Huawei Local Security Checks	high
147504	EulerOS Virtualization 2.9.1 : cups (EulerOS-SA-2021-1595)	Nessus	Huawei Local Security Checks	high
147127	EulerOS Virtualization for ARM 64 3.0.6.0 : cups (EulerOS-SA-2021-1573)	Nessus	Huawei Local Security Checks	high
145896	CentOS 8 : cups (CESA-2020:4469)	Nessus	CentOS Local Security Checks	high
142789	Oracle Linux 8 : cups (ELSA-2020-4469)	Nessus	Oracle Linux Local Security Checks	high
142511	EulerOS Virtualization 3.0.6.6 : cups (EulerOS-SA-2020-2464)	Nessus	Huawei Local Security Checks	high
142426	RHEL 8 : cups (RHSA-2020:4469)	Nessus	Red Hat Local Security Checks	high
142266	EulerOS 2.0 SP2 : cups (EulerOS-SA-2020-2336)	Nessus	Huawei Local Security Checks	high
142166	EulerOS 2.0 SP8 : cups (EulerOS-SA-2020-2306)	Nessus	Huawei Local Security Checks	high
142098	EulerOS 2.0 SP5 : cups (EulerOS-SA-2020-2241)	Nessus	Huawei Local Security Checks	high
140344	EulerOS Virtualization for ARM 64 3.0.2.0 : cups (EulerOS-SA-2020-1974)	Nessus	Huawei Local Security Checks	high
137793	FreeBSD : CUPS -- memory corruption (ce0c8590-b628-11ea-9d28-3c970ee9157c)	Nessus	FreeBSD Local Security Checks	high
137207	Debian DLA-2237-1 : cups security update	Nessus	Debian Local Security Checks	high
136378	Fedora 30 : 1:cups (2020-5a4da65166)	Nessus	Fedora Local Security Checks	high
136152	Fedora 31 : 1:cups (2020-67c84f3f49)	Nessus	Fedora Local Security Checks	high
136029	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : CUPS vulnerabilities (USN-4340-1)	Nessus	Ubuntu Local Security Checks	high
136012	openSUSE Security Update : cups (openSUSE-2020-555)	Nessus	SuSE Local Security Checks	high
135964	SUSE SLED15 / SLES15 Security Update : cups (SUSE-SU-2020:1083-1)	Nessus	SuSE Local Security Checks	high
135961	SUSE SLES12 Security Update : cups (SUSE-SU-2020:1045-1)	Nessus	SuSE Local Security Checks	high
134954	macOS 10.15.x < 10.15.4 / 10.14.x < 10.14.6 Security Update 2020-002 / 10.13.x < 10.13.6 Security Update 2020-002	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2020-3898

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical