SB2024092712 - Input validation error in OpenPrinting libcupsfilters
Published: September 27, 2024 Updated: November 22, 2024
Security Bulletin ID
SB2024092712
Severity
High
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2024-47076)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to cfGetPrinterAttributes5 does not sanitize IPP attributes returned from an IPP server. A remote attacker can provide controlled data to the rest of the CUPS system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.
References
- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
- https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
- https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
- https://www.cups.org
- https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
- https://github.com/OpenPrinting/libcupsfilters/releases/tag/2.1.0