CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
28.0%
CUPS is a standards-based, open-source printing system, and libppd
can be used for legacy PPD file support. The libppd
function ppdCreatePPDFromIPP2
does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5
, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
security-tracker.debian.org/tracker/CVE-2024-47175
security.alpinelinux.org/vuln/CVE-2024-47175
www.cups.org
www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
28.0%