CVE-2019-2228

NameCVE-2019-2228
DescriptionIn array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2047-1
Debian Bugs946782

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)jessie, jessie (lts)1.7.5-11+deb8u12fixed
stretch (security)2.2.1-8+deb9u8fixed
stretch (lts), stretch2.2.1-8+deb9u12fixed
buster, buster (lts)2.2.10-6+deb10u11fixed
buster (security)2.2.10-6+deb10u10fixed
bullseye2.3.3op2-3+deb11u8fixed
bullseye (security)2.3.3op2-3+deb11u9fixed
bookworm (security), bookworm2.4.2-3+deb12u8fixed
sid, trixie2.4.10-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssourcewheezy(not affected)
cupssourcejessie1.7.5-11+deb8u7DLA-2047-1
cupssourcestretch2.2.1-8+deb9u5
cupssourcebuster2.2.10-6+deb10u2
cupssource(unstable)2.3.1-1946782

Notes

https://github.com/apple/cups/commit/b018978c278d42c7abf78941251b887c95dfdb07 (master, v2.3.1)
https://github.com/apple/cups/commit/8c9b3606cca99e5dfc51784a9de1634345db7579 (v2.2.13)
[wheezy] - cups <not-affected> (Vulnerable code was introduced later)

Search for package or bug name: Reporting problems