GoogleOSV:CVE-2024-47175CVE-2024-47175
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
14.9%
CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
References
github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
security-tracker.debian.org/tracker/CVE-2024-47175
security.alpinelinux.org/vuln/CVE-2024-47175
www.cups.org
www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
14.9%