CVE-2024-47076

Description

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.

Reserved 2024-09-17 | Published 2024-09-26 | Updated 2024-09-28 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

<= 2.1b1
affected

References

github.com/...ilters/security/advisories/GHSA-w63j-6g73-wmg5

github.com/...rowsed/security/advisories/GHSA-rj88-6mr5-rcw8

github.com/...ilters/security/advisories/GHSA-p9rh-jxmq-gq47

github.com/...libppd/security/advisories/GHSA-7xfx-47qg-grp6

www.cups.org

www.evilsocket.net/...Attacking-UNIX-systems-via-CUPS-Part-I

cve.org (CVE-2024-47076)

nvd.nist.gov (CVE-2024-47076)

Download JSON