CVE-2019-13171: xerox phaser_3320_firmware Out-of-bounds Write

Vulnerability summary

CVE-2019-13171 is a high (CVSS 10.0) Out-of-bounds Write vulnerability in xerox phaser_3320_firmware. EPSS estimates a 2.81% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities.

Timeline

1. 13-03-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementation that would allow an unauthenticated attacker to execute arbitrary code on the device. This was caused by an insecure handling of the register parameters, because the size used within a memcpy() function, which copied the action value into a local variable, was not checked properly.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.