PT-2024-6502 · Unknown+11 · Libcupsfilters+11
Evilsocket
·
Published
2024-09-26
·
Updated
2026-05-12
·
CVE-2024-47076
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
CUPS versions prior to the fixed version
Description
The issue is related to the
cfGetPrinterAttributes5 function in libcupsfilters, which does not sanitize IPP attributes returned from an IPP server. This can lead to attacker-controlled data being provided to the rest of the CUPS system, potentially allowing a remote attacker to disclose protected information. The vulnerability is actively being exploited.Recommendations
As a temporary workaround, consider disabling the
cfGetPrinterAttributes5 function until a patch is available. Restrict access to the vulnerable libcupsfilters module to minimize the risk of exploitation. Avoid using unsanitized IPP attributes in the affected CUPS system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Cups
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Libcupsfilters