CVE-2020-3898

NameCVE-2020-3898
DescriptionA memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2237-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)jessie, jessie (lts)1.7.5-11+deb8u12fixed
stretch (security)2.2.1-8+deb9u8fixed
stretch (lts), stretch2.2.1-8+deb9u12fixed
buster, buster (lts)2.2.10-6+deb10u11fixed
buster (security)2.2.10-6+deb10u10fixed
bullseye2.3.3op2-3+deb11u8fixed
bullseye (security)2.3.3op2-3+deb11u9fixed
bookworm2.4.2-3+deb12u7fixed
bookworm (security)2.4.2-3+deb12u8fixed
sid, trixie2.4.10-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssourcewheezy(unfixed)end-of-life
cupssourcejessie1.7.5-11+deb8u8DLA-2237-1
cupssourcestretch2.2.1-8+deb9u6
cupssourcebuster2.2.10-6+deb10u3
cupssource(unstable)2.3.1-12

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=1823964
https://src.fedoraproject.org/rpms/cups/blob/c1920d09b842bd2d0611559d00d595abd8aa2424/f/cups-ppdopen-heap-overflow.patch
https://github.com/apple/cups/commit/82e3ee0e3230287b76a76fb8f16b92ca6e50b444 (cups/ppd.c, ppdc/ppdc-source.cxx)

Search for package or bug name: Reporting problems