Input validation error in libppd - CVE-2024-47175

Vulnerability identifier: #VU97745

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-47175

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. A remote attacker can inject attacker-controlled data in the resulting PPD.

libppd
SUSE Linux Enterprise Server 15 SP5
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Manager Retail Branch Server 4.3
SUSE Manager Proxy 4.3
Oracle Linux
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Basesystem Module
Desktop Applications Module
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Chrome OS
Event Processing
IBM Business Automation Manager Open Editions
IBM Event Endpoint Management
Business Automation Insights
watsonx Assistant for IBM Cloud Pak for Data
Watson CP4D Data Stores
Cryostat
IBM Cloud Pak for Security
Ansible Automation Platform
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
OpenShift Logging
IBM Cloud Pak for Business Automation
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
cups (Ubuntu package)
cups-filters (Red Hat package)
cups-filters-libs
cups-filters-devel
cups-filters
cups-filters-doc
cups-filters-debugsource
cups-filters-debuginfo
cups-filters-help
libppd2 (Ubuntu package)
libppd-utils (Ubuntu package)
cups-browsed
libppd
libcupsfilters
cups (Red Hat package)
cups-doc
cups-filesystem
cups-lpd
cups-libs
cups-ipptool
cups-devel
cups-client
cups
libcupsmime1-debuginfo
cups-config
libcups2
cups-debugsource
cups-debuginfo
libcupscgi1
libcupscgi1-debuginfo
libcupsppdc1-debuginfo
libcupscgi1-32bit
libcupsmime1-32bit-debuginfo
libcupscgi1-32bit-debuginfo
libcupsimage2-32bit-debuginfo
cups-devel-32bit
libcupsmime1-32bit
libcupsimage2-32bit
libcupsppdc1-32bit-debuginfo
libcupsppdc1-32bit
cups-ddk
cups-ddk-debuginfo
libcups2-32bit
libcups2-32bit-debuginfo
libcupsppdc1
libcupsmime1
libcupsimage2-debuginfo
libcups2-debuginfo
cups-client-debuginfo
libcupsimage2
cups-help
cups-printerapp
cups (Debian package)
Event Streams
OpenShift API for Data Protection (OADP)

Install update from vendor's website.

libppd - update to 2.1.0
Event Processing - update to 1.2.2
IBM Business Automation Manager Open Editions - update to 8.0.7
IBM Event Endpoint Management - update to 11.3.2
Event Streams - update to 11.5.1
Business Automation Insights - update to 24.0.0.0.2
cups (Ubuntu package) - addressed in versions Ubuntu Pro, 2.3.1-9ubuntu1.9, 2.4.1op1-1ubuntu4.11, 2.4.7-1.2ubuntu7.3
cups-filters (Red Hat package) - addressed in versions 1.0.35-26.el7_7.3, 1.0.35-29.el7_9.3, 1.20.0-19.el8_2.2, 1.20.0-24.el8_4.2, 1.20.0-27.el8_6.3, 1.20.0-29.el8_8.3, 1.20.0-35.el8_10, 1.28.7-10.el9_0.2, 1.28.7-11.el9_2.2, 1.28.7-17.el9_4
cups-filters-libs - addressed in versions 1.0.35-29, 1.20.0-35.0.1
cups-filters-devel - addressed in versions 1.0.35-29, 1.20.0-35.0.1
cups-filters - addressed in versions 1.0.35-29, 1.20.0-35.0.1
OpenShift API for Data Protection (OADP) - addressed in versions 1.3.4, 1.4.2
IBM Cloud Pak for Security - update to 1.11.0.0
cups-filters-doc - update to 1.20.0-35.0.1
cups-filters-debugsource - addressed in versions 1.25.0-150200.3.22.1, 1.25.0-150200.3.28.1
cups-filters - addressed in versions 1.25.0-150200.3.22.1, 1.25.0-150200.3.28.1
cups-filters-devel - addressed in versions 1.25.0-150200.3.22.1, 1.25.0-150200.3.28.1
cups-filters-debuginfo - addressed in versions 1.25.0-150200.3.22.1, 1.25.0-150200.3.28.1
cups-filters-debugsource - update to 1.28.9-5
cups-filters-devel - update to 1.28.9-5
cups-filters-help - update to 1.28.9-5
cups-filters-debuginfo - update to 1.28.9-5
cups-filters - update to 1.28.9-5
libppd2 (Ubuntu package) - update to 2:2.0.0-0ubuntu4.1
libppd-utils (Ubuntu package) - update to 2:2.0.0-0ubuntu4.1
cups-browsed - addressed in versions 2.0.1-3.fc39, 2.0.1-3.fc40
libppd - addressed in versions 2.1~b1-2.fc39, 2.1~b1-2.fc40
libcupsfilters - addressed in versions 2.1~b1-3.fc39, 2.1~b1-3.fc40
cups (Red Hat package) - addressed in versions 2.2.6-62.el8_10, 2.3.3op2-31.el9_5
cups-doc - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups-filesystem - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups-lpd - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups-libs - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups-ipptool - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups-devel - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups-client - addressed in versions 2.2.6-62.0.1, 2.4.10-2
cups - addressed in versions 2.2.6-62.0.1, 2.4.10-2
libcupsmime1-debuginfo - update to 2.2.7-150000.3.72.1
cups-config - update to 2.2.7-150000.3.72.1
libcups2 - update to 2.2.7-150000.3.72.1
cups-debugsource - update to 2.2.7-150000.3.72.1
cups-devel - update to 2.2.7-150000.3.72.1
cups-debuginfo - update to 2.2.7-150000.3.72.1
libcupscgi1 - update to 2.2.7-150000.3.72.1
libcupscgi1-debuginfo - update to 2.2.7-150000.3.72.1
libcupsppdc1-debuginfo - update to 2.2.7-150000.3.72.1
libcupscgi1-32bit - update to 2.2.7-150000.3.72.1
libcupsmime1-32bit-debuginfo - update to 2.2.7-150000.3.72.1
libcupscgi1-32bit-debuginfo - update to 2.2.7-150000.3.72.1
libcupsimage2-32bit-debuginfo - update to 2.2.7-150000.3.72.1
cups-devel-32bit - update to 2.2.7-150000.3.72.1
libcupsmime1-32bit - update to 2.2.7-150000.3.72.1
libcupsimage2-32bit - update to 2.2.7-150000.3.72.1
libcupsppdc1-32bit-debuginfo - update to 2.2.7-150000.3.72.1
libcupsppdc1-32bit - update to 2.2.7-150000.3.72.1
cups-ddk - update to 2.2.7-150000.3.72.1
cups-ddk-debuginfo - update to 2.2.7-150000.3.72.1
libcups2-32bit - update to 2.2.7-150000.3.72.1
libcups2-32bit-debuginfo - update to 2.2.7-150000.3.72.1
libcupsppdc1 - update to 2.2.7-150000.3.72.1
libcupsmime1 - update to 2.2.7-150000.3.72.1
libcupsimage2-debuginfo - update to 2.2.7-150000.3.72.1
libcups2-debuginfo - update to 2.2.7-150000.3.72.1
cups-client - update to 2.2.7-150000.3.72.1
cups - update to 2.2.7-150000.3.72.1
cups-client-debuginfo - update to 2.2.7-150000.3.72.1
libcupsimage2 - update to 2.2.7-150000.3.72.1
Ansible Automation Platform - addressed in versions 2.4, 2.5
cups-client - addressed in versions 2.4.0-13, 2.4.7-5
cups-debuginfo - addressed in versions 2.4.0-13, 2.4.7-5
cups - addressed in versions 2.4.0-13, 2.4.7-5
cups-help - addressed in versions 2.4.0-13, 2.4.7-5
cups-filesystem - addressed in versions 2.4.0-13, 2.4.7-5
cups-printerapp - addressed in versions 2.4.0-13, 2.4.7-5
cups-lpd - addressed in versions 2.4.0-13, 2.4.7-5
cups-libs - addressed in versions 2.4.0-13, 2.4.7-5
cups-ipptool - addressed in versions 2.4.0-13, 2.4.7-5
cups-devel - addressed in versions 2.4.0-13, 2.4.7-5
cups-debugsource - addressed in versions 2.4.0-13, 2.4.7-5
cups (Debian package) - update to 2.4.2-3+deb12u8
cups-printerapp - update to 2.4.10-2
cups - addressed in versions 2.4.10-7.fc39, 2.4.10-7.fc40
Red Hat OpenShift Dev Spaces - update to 3.17.0
watsonx Assistant for IBM Cloud Pak for Data - update to 4.8.8
App Connect Enterprise Certified Container - addressed in versions 5.0.18, 11.5.0, 12.0.12.0-r1
Watson CP4D Data Stores - update to 5.1
OpenShift Logging - update to 5.8.16
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Chrome OS - update to 126.0.6478.254

• Exploit #10879 - CUPS IPP Attributes LAN Remote Code Execution (November 22, 2024)

• https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
• https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
• https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
• https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
• https://www.cups.org
• https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
• https://github.com/OpenPrinting/libppd/releases/tag/2.1.0

• Input validation error in OpenPrinting libppd
• Ubuntu update for libppd
• Ubuntu update for cups
• Fedora 40 update for cups, cups-browsed, libcupsfilters, libppd
• Fedora 39 update for cups, cups-browsed, libcupsfilters, libppd
• Debian update for cups
• Red Hat Enterprise Linux 9 update for cups-filters
• IBM App Connect Enterprise Certified Container update for OpenPrinting libppd
• IBM App Connect Enterprise Certified Container update for OpenPrinting libppd
• IBM App Connect Enterprise Certified Container update for OpenPrinting libppd
• Ubuntu update for cups
• Red Hat Enterprise Linux 8 update for cups-filters
• Red Hat Enterprise Linux 8 update for cups-filters
• Red Hat Enterprise Linux 8 update for cups-filters
• Red Hat Enterprise Linux 9 update for cups-filters
• Red Hat Enterprise Linux 8 update for cups-filters
• Red Hat Enterprise Linux 9 update for cups-filters
• Red Hat Enterprise Linux 7 update for cups-filters
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for cups-filters
• Multiple vulnerabilities in Google ChromeOS LTS
• Red Hat Enterprise Linux 8 update for cups-filters
• Ubuntu update for cups
• openEuler update for cups-filters
• openEuler 22.03 LTS SP4 update for cups
• openEuler 24.03 LTS update for cups
• openEuler 22.03 LTS SP1 update for cups
• openEuler 22.03 LTS SP3 update for cups
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 9 update for cups
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Red Hat Enterprise Linux 8 update for cups
• Multiple vulnerabilities in IBM Watson CP4D Data Stores
• Red Hat Cryostat 3 update for golang
• Multiple vulnerabilities in OpenShift Logging 5.8
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Multiple vulnerabilities in IBM watsonx Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Business Automation Insights
• Anolis OS update for cups-filters
• Anolis OS update for cups-filters
• Anolis OS update for cups
• IBM Business Automation Manager Open Editions update for OpenPrinting libppd
• SUSE update for cups-filters
• SUSE update for cups
• Anolis OS update for cups
• SUSE update for cups-filters