Skip to content
Fencer Vulns
high 7.0

CVE-2023-4504 json

OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

published 2023-09-21 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-54359

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

Patch / fix

  • OpenPrinting CUPS 2.4.6
  • cups Debian 12 2.4.2-3+deb12u2
  • cups Debian 14, Debian 13 2.4.2-6

debian advisories DEBIAN-CVE-2023-4504

  • cups Ubuntu 20.04 LTS 2.3.1-9ubuntu1.6
  • cups Ubuntu 22.04 LTS 2.4.1op1-1ubuntu4.7
  • cups Ubuntu Pro 16.04 LTS 2.1.3-4ubuntu0.11+esm4
  • cups Ubuntu Pro 18.04 LTS 2.2.7-1ubuntu2.10+esm2

ubuntu advisories UBUNTU-CVE-2023-4504

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups Linux Micro 6.0 2.4.11-1.1
  • cups SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, SLE Module for Desktop Applications 15 SP5 +21 more 2.2.7-150000.3.51.2
  • cups SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 1.7.5-20.46.1

suse advisories SUSE-SU-2025:20090-1SUSE-SU-2023:3707-2SUSE-SU-2023:3707-1SUSE-SU-2023:3706-1

  • cups openSUSE Tumbleweed 2.4.2-7.1

opensuse advisories openSUSE-SU-2024:13250-1

  • cups Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.4.7-r0

alpine advisories ALPINE-CVE-2023-4504

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups CBL-Mariner 2.0 2.3.3op2-7
  • cups Azure Linux 3.0 2.4.10-1

azure linux advisories AZL-37075AZL-37100

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4504 updated cvss 7.0

libppd: Postscript Parsing Heap Overflow

  • Red Hat Enterprise Linux 6 cups, cups-lpd, cups-php, cups-libs Red Hat Enterprise Linux 7 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem Red Hat Enterprise Linux 9 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem, +1 more
    affected: workaround, no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h referenced PoC, tagged "exploit" by a source, unverified
  • takeonme.org https://takeonme.org/cves/CVE-2023-4504.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • OpenPrinting CUPS
  • OpenPrinting libppd

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.