Arbitrary Command Execution

🗓️ 27 Sep 2024 15:29:40Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 3 Views

cups allows arbitrary command execution due to unsanitized attributes in ppdCreatePPDFromIPP2 function.

Reporter	Title	Published	Views	Family All 361
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Endpoint Management	13 Nov 202411:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Processing	13 Nov 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenPrinting affects IBM watsonx Assistant for IBM Cloud Pak for Data	4 Feb 202521:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202518:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	13 Nov 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to arbitrary code execution [CVE-2024-47175]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Data Management Console. (CVE-2023-51775, CVE-2023-23916, CVE-2025-27363, CVE-2024-38819, CVE-2024-45801, CVE-2024-47176, CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, CVE-2024-29857)	21 Oct 202506:11	–	ibm
IBM Security Bulletins	Security Bulletin: cups vulnerability in BAMOE 8.0.5 images	16 Jun 202512:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to multiple CUPS ivulnerabilities	8 Jan 202516:58	–	ibm

Vulners

Node

cups cupsMatch2.3.3op2-7debian

AND

debian debian_linuxMatch12

libppd-dev libppd-devMatch2:0.10-7.3debian

AND

debian debian_linuxMatch11

cups cupsMatch2.3.3-4debian

AND

cups cupsMatch2.3.3op2-7debian

AND

cups cupsMatch2.3.3op2-3debian

AND

debian debian_linuxMatch999

cups cupsMatch2.3.3op2-3+deb11u1debian

AND

cups cupsMatch2.3.3-4debian

AND

debian debian_linuxMatch11

cups cupsMatch2.4.9-r0os

AND

cups cupsMatch2.4.8-r0os

AND

cups cupsMatch2.4.7-r4os

AND

alpinelinux alpine_linuxMatch3.20

cups cupsMatch2.4.2-r2os

AND

cups cupsMatch2.4.2-r3os

AND

cups cupsMatch2.4.2-r6os

AND

cups cupsMatch2.4.2-r4os

AND

cups cupsMatch2.4.8-r0os

AND

cups cupsMatch2.2.12-r2os

AND

cups cupsMatch2.4.5-r0os

AND

cups cupsMatch2.4.4-r0os

AND

cups cupsMatch2.4.0-r0os

AND

cups cupsMatch2.4.7-r3os

AND

cups cupsMatch2.4.2-r5os

AND

cups cupsMatch2.3.3-r3os

AND

cups cupsMatch2.4.2-r0os

AND

cups cupsMatch2.3.3-r0os

AND

cups cupsMatch2.4.6-r0os

AND

cups cupsMatch2.4.7-r2os

AND

cups cupsMatch2.2.12-r1os

AND

cups cupsMatch2.4.1-r1os

AND

cups cupsMatch2.4.1-r0os

AND

cups cupsMatch2.4.10-r0os

AND

cups cupsMatch2.4.7-r0os

AND

cups cupsMatch2.4.7-r4os

AND

cups cupsMatch2.4.2-r1os

AND

cups cupsMatch2.3.3-r2os

AND

cups cupsMatch2.3.3-r4os

AND

cups cupsMatch2.4.9-r0os

AND

alpinelinux alpine_linuxMatchedge

cups cupsMatch2.4.9-r0os

AND

cups cupsMatch2.4.7-r0os

AND

alpinelinux alpine_linuxMatch3.19

cups cupsRange2.2.6__25.el8–2.2.6__57.el8

Source	Link
evilsocket	www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
github	www.github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
github	www.github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
github	www.github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
github	www.github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477
github	www.github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
lists	www.lists.debian.org/debian-lts-announce/2024/09/msg00047.html
cups	www.cups.org/
evilsocket	www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
openwall	www.openwall.com/lists/oss-security/2024/09/27/3

28 Nov 2024 10:57Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.6

EPSS0.87593

SSVC