CVE-2020-6923: 
Linux Debian vulnerability analysis and mitigation

The HP Linux Imaging and Printing (HPLIP) software was found to be vulnerable to memory buffer overflow, identified as CVE-2020-6923. The vulnerability was discovered by Kevin Backhouse of GitHub Security Lab and reported to HP in April 2020. This security issue affected all versions of HPLIP software 3.20.8 and earlier (HP Security).

The vulnerability exists in multiple components of HPLIP, primarily in the protocol/discovery/mdns.c file. The main issues include a heap buffer overflow in mdnsreadName function, a stack buffer overflow in mdnsupdateuris, and an out-of-bounds read in mdnsparse_respponse. The vulnerability received a CVSS 3.0 Base Score of 5.7 with a vector of AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (GitHub Security Lab).

The vulnerability could potentially lead to remote code execution, where 'remote' means a device or computer connected to the same network as the victim. In a typical office environment, the malicious device would need to be somewhere inside the building. Mitigations such as ASLR may make it difficult for an attacker to create a reliable RCE exploit (GitHub Security Lab).

HP released version 3.20.9 of the HPLIP software to address these vulnerabilities. Users are advised to upgrade to HPLIP version 3.20.9 or higher. The updated software can be obtained from the HP Linux Imaging and Printing developers website (HP Security).