PT-2024-6503 · Cups+10 · Cups+10
Evilsocket
·
Published
2024-09-26
·
Updated
2026-05-13
·
CVE-2024-47175
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CUPS (affected versions not specified)
Description
The issue is related to the
libppd function ppdCreatePPDFromIPP2 not sanitizing IPP attributes when creating the PPD buffer. This can result in user-controlled input and ultimately code execution via Foomatic, potentially leading to remote code execution (RCE). The vulnerability can be part of an exploit chain and may allow an attacker to write arbitrary data to the resulting PPD file.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Cups
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu