7.1

CVE-2023-34241: apple macos Use After Free

CVSS: 7.1v3.1HighModified
AliasesALPINE-CVE-2023-34241MGASA-2023-0223SUSE-SU-2023:2616-1
Published 22-06-2023Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2023-34241 is a high (CVSS 7.1) Use After Free vulnerability in apple macos. EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 71.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
39/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (NVD)
EPSS score
1.38%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 6 · Related 2
RHSA-2023:6596RHSA-2023:7165RHSA-2024:1101RHSA-2024:1409SUSE-SU-2023:3706-1SUSE-SU-2025:20090-1

Timeline

  1. 22-06-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.38%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

0.00 pp

From 1.38% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Cups

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Suse23 products
  • cups&distro=SUSE Enterprise Storage 7< 2.2.7-150000.3.46.1
  • cups&distro=SUSE Enterprise Storage 7.1< 2.2.7-150000.3.46.1
  • cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.2.7-150000.3.46.1
  • cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.2.7-150000.3.46.1
  • cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 2.2.7-150000.3.46.1
Opensuse4 products
  • cups&distro=openSUSE Leap 15.4< 2.2.7-150000.3.46.1
  • cups&distro=openSUSE Leap 15.5< 2.2.7-150000.3.46.1
  • cups&distro=openSUSE Leap Micro 5.3< 2.2.7-150000.3.46.1
  • cups&distro=openSUSE Tumbleweed< 2.4.2-6.1
Debian2 products
  • cups< 2.4.2-3+deb12u1 | < 2.4.2-5 | < 2.2.10-6+deb10u8
  • debian_linuxEOL10.0
Alpine1 product
  • cups≥ 2.2.0, < 2.3.3-r8 | ≥ 2.2.0, < 2.4.2-r2 | ≥ 2.2.0, < 2.4.2-r3
Apple1 product
  • macos< 11.7.9 | ≥ 12.0.0, < 12.6.8 | ≥ 13.0, < 13.5
Fedoraproject1 product
Mageia1 product
  • cups< 2.3.3op2-1.3.mga8
Openprinting1 product
  • cups≥ 2.0.0, < 2.4.6 | ≥ 2.2.0, < 2.4.6
Ubuntu1 product
  • cups< 2.3.1-9ubuntu1.4 | < 2.4.1op1-1ubuntu4.4 | < 2.1.3-4ubuntu0.11+esm3 | < 2.2.7-1ubuntu2.10+esm1

9 vendors · 35 products

References

24 links
Show all 24 references