Logo
›
›vulnerability›CVE-2024-47175
Name
CVE-2024-47175
Source
NVD ( link)Debian ( link)
Description
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
CWEs
CWE-20
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8Not Applicable
https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47Not Applicable
https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5Not Applicable
https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6Exploit
https://www.cups.orgProduct
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-IExploit
http://www.openwall.com/lists/oss-security/2024/09/27/3Mailing List
https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477Patch
https://lists.debian.org/debian-lts-announce/2024/09/msg00047.htmlMailing List

Analysis#

Affected Component
Analysis
libppd
Patched

Vulnerability Ratings#

8.6
CVSSv31
9.8
CVSSv31
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
libppd
yocto
master
2.1.1
Not Affected

Resolved with patches#

libppd (yocto:scarthgap)

#
Title
Author
Resolve
1
CVE-2024-47175
Zdenek Dohnal <zdohnal@redhat.com>
CVE-2024-47175