CVE-2023-34095

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of `scanf(3)`. cpdb-libs uses the `fscanf()` and `scanf()` functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by `fscanf()` and `scanf()` causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of `%s` with `%1023s` in all calls of the `fscanf()` and `scanf()` functions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 14, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-340968.8Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 anCVE-2023-340978.8hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showCVE-2023-340985.3Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the JavCVE-2023-340995.3Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to constrCVE-2023-34105.4The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, CVE-2023-341006.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packetCVE-2023-341019.1Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_inpCVE-2023-341028.8Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updatinCVE-2023-341035.4Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site ScriptCVE-2023-341047.5fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaCVE-2023-341057.5SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and CVE-2023-341066.5GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect r
CVE-2023-34095: Critical severity, CVSS 9.8 | Vulnix