CVE-2025-57812
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-57812
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57812.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-57812
- Aliases
-
- GHSA-jpxg-qc2c-hgv4
- Downstream
- Related
- Published
- 2025-11-12T18:46:52.801Z
- Modified
- 2025-11-25T00:52:56.685637Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`
- Details
-
CUPS is a standards-based, open-source printing system, and
libcupsfilterscontains the code of the filters of the formercups-filterspackage as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters'simagetorasterfilter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which theimagetorasterfilter or its C-function equivalentcfFilterImageToRaster()gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is_cfImageReadTIFF() in libcupsfilters. When this function is invoked as part ofcfFilterImageToRaster(), the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in_cupsImageReadTIFF(), which is called throughcupsImageOpen()from theimagetorastertool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa. - Database specific
{ "cwe_ids": [ "CWE-125", "CWE-787" ] }- References
-
- http://www.openwall.com/lists/oss-security/2025/11/12/1
- https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/cupsfilters/image-tiff.c#L34
- https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/filter/imagetoraster.c#L613
- https://github.com/OpenPrinting/libcupsfilters/blob/33421982e10f6a14bc0bab03b80c9cf4660e8d7d/cupsfilters/image-tiff.c#L32
- https://github.com/OpenPrinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa
- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-jpxg-qc2c-hgv4
Affected packages
Git / github.com/openprinting/cups-filters
Affected versions
1.*
Other
release-1-17.*
v1.*
Git / github.com/openprinting/libcupsfilters
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openprinting/libcupsfilters
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 28354.0,
"function_hash": "42061243208070445012433084390695591297"
},
"signature_version": "v1",
"source": "https://github.com/openprinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa",
"target": {
"file": "cupsfilters/image-tiff.c",
"function": "_cfImageReadTIFF"
},
"id": "CVE-2025-57812-4b514f94"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"144092593580005849854924672436864359879",
"268467096553739066157191709429381230563",
"73408120116374618912511194460729732022",
"259688319932037534707326190093504878263",
"278637253073213825274842409204617117298",
"328876288284172116653315108458453719210",
"284318475568752388442543439574439151862",
"35793819940051320735723399004621636386",
"276274438708956468648106533399562029955",
"45298253840901734379500417749883328203",
"303718138438959447101012788654697268729",
"287523501029936878676155523795954706719",
"295531895687332224484492994010739423243",
"47766084698459693366748869305166719487",
"234595296254816083432546770438148117004",
"24016057993650718314721635921641132991",
"332908557626701948156169608162874374485",
"255283499068089034843772883205291415346",
"11202868597098166405204363879487117969",
"187934681950567824374783233702268724098"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/openprinting/libcupsfilters/commit/b69dfacec7f176281782e2f7ac44f04bf9633cfa",
"target": {
"file": "cupsfilters/image-tiff.c"
},
"id": "CVE-2025-57812-57828aab"
}
]