CVE-2020-6923: 
Linux Debian vulnerability analysis and mitigation

The HP Linux Imaging and Printing (HPLIP) software was found to be vulnerable to memory buffer overflow, identified as CVE-2020-6923. The vulnerability was discovered by Kevin Backhouse of GitHub Security Lab and reported to HP in April 2020. This security issue affected all versions of HPLIP software 3.20.8 and earlier (HP Security).

The vulnerability exists in multiple components of HPLIP, primarily in the protocol/discovery/mdns.c file. The main issues include a heap buffer overflow in mdns_readName function, a stack buffer overflow in mdns_update_uris, and an out-of-bounds read in mdns_parse_respponse. The vulnerability received a CVSS 3.0 Base Score of 5.7 with a vector of AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (GitHub Security Lab).

The vulnerability could potentially lead to remote code execution, where 'remote' means a device or computer connected to the same network as the victim. In a typical office environment, the malicious device would need to be somewhere inside the building. Mitigations such as ASLR may make it difficult for an attacker to create a reliable RCE exploit (GitHub Security Lab).

The vulnerability can be triggered when an application such as simple-scan searches the network for scanners, which happens immediately when simple-scan starts. Any device connected to the same network can receive the broadcast message and respond to it, potentially exploiting the vulnerability through a malicious response (GitHub Security Lab).

HP released version 3.20.9 of the HPLIP software to address these vulnerabilities. Users are advised to upgrade to HPLIP version 3.20.9 or higher. The updated software can be obtained from the HP Linux Imaging and Printing developers website (HP Security).