CVE-2024-47076

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47076
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 Not Applicable
https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 Not Applicable
https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 Exploit Vendor Advisory
https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 Not Applicable
https://www.cups.org Product
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I Exploit Third Party Advisory
https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openprinting:libcupsfilters:*:*:*:*:*:*:*:*
cpe:2.3:a:openprinting:libcupsfilters:2.1:beta1:*:*:*:*:*:*
History

29 Sep 2025, 13:26

Type Values Removed Values Added
References () https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 - () https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 - Not Applicable
References () https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 - () https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 - Not Applicable
References () https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 - () https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 - Exploit, Vendor Advisory
References () https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 - () https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 - Not Applicable
References () https://www.cups.org - () https://www.cups.org - Product
References () https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I - () https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I - Exploit, Third Party Advisory
References () https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018 - () https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018 - Patch
CPE cpe:2.3:a:openprinting:libcupsfilters:2.1:beta1:*:*:*:*:*:*
cpe:2.3:a:openprinting:libcupsfilters:*:*:*:*:*:*:*:*
First Time Openprinting
Openprinting libcupsfilters
CWE NVD-CWE-noinfo

21 Nov 2024, 09:39

Type Values Removed Values Added
References
  • () https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018 -

30 Sep 2024, 12:46

Type Values Removed Values Added
Summary
  • (es) CUPS es un sistema de impresión de código abierto basado en estándares, y `libcupsfilters` contiene el código de los filtros del antiguo paquete `cups-filters` como funciones de librería que se utilizarán para las tareas de conversión de formato de datos necesarias en las aplicaciones de impresora. La función `cfGetPrinterAttributes5` en `libcupsfilters` no desinfecta los atributos IPP devueltos desde un servidor IPP. Cuando estos atributos IPP se utilizan, por ejemplo, para generar un archivo PPD, esto puede provocar que se proporcionen datos controlados por un atacante al resto del sistema CUPS.

26 Sep 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-26 22:15

Updated : 2025-09-29 13:26

NVD link : CVE-2024-47076

Mitre link : CVE-2024-47076

CVE.ORG link : CVE-2024-47076

JSON object : View

Products Affected

openprinting

  • libcupsfilters
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo