p PatchFirst

CVE-2024-47076

CVE-2024-47076 · libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.

CVSS 8.6 · High · EPSS 79.9% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libcupsfilters

    Versions
    • <= 2.1b1: Affected

    No fix published

  • cups-filters Debian:12

    Versions
    • 1.28.17-3
    Affected ranges
    • ECOSYSTEM: < 1.28.17-3+deb12u1

    Update to 1.28.17-3+deb12u1

  • cups-filters Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.28.17-5

    Update to 1.28.17-5

  • cups-filters Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.28.17-5

    Update to 1.28.17-5

  • libcupsfilters Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.0.0-3

    Update to 2.0.0-3

  • libcupsfilters Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.0.0-3

    Update to 2.0.0-3

  • cups-filters Ubuntu:20.04:LTS

    Versions
    • 1.25.11-0ubuntu1
    • 1.25.11-1
    • 1.25.12-1
    • 1.25.13-1
    • 1.26.0-1
    • 1.26.1-1
    • 1.26.2-1
    • 1.27.0-1
    • 1.27.0-2
    • 1.27.1-1
    • 1.27.1-2
    • 1.27.1-3
    • 1.27.2-1
    • 1.27.3-1
    • 1.27.4-1
    • 1.27.4-1ubuntu0.2
    • 1.27.4-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 1.27.4-1ubuntu0.4

    Update to 1.27.4-1ubuntu0.4

  • cups-filters Ubuntu:22.04:LTS

    Versions
    • 1.28.10-2
    • 1.28.11-1
    • 1.28.11-2
    • 1.28.12-1
    • 1.28.13-0ubuntu1
    • 1.28.14-1
    • 1.28.15-0ubuntu1
    • 1.28.15-0ubuntu1.2
    • 1.28.15-0ubuntu1.3
    Affected ranges
    • ECOSYSTEM: < 1.28.15-0ubuntu1.4

    Update to 1.28.15-0ubuntu1.4

  • libcupsfilters Ubuntu:24.04:LTS

    Versions
    • 2.0.0-0ubuntu1
    • 2.0.0-0ubuntu6
    • 2.0.0-0ubuntu7
    Affected ranges
    • ECOSYSTEM: < 2.0.0-0ubuntu7.1

    Update to 2.0.0-0ubuntu7.1

Original sources

Check your server →