CVE-2024-47076

Katalog CVE

CVSS 8.6 · High EPSS 79,9%

Kerentanan Improper Input Validation pada openprinting libcupsfilters. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.

Rincian

Terbit di NVD

26 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

79,9% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 exploit · advisory vendor
• https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018 patch
• https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I exploit · advisory pihak ketiga
• https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 not applicable
• https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 not applicable
• https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 not applicable
• https://www.cups.org product
• https://lists.debian.org/debian-lts-announce/2024/09/msg00048.html
• https://security.netapp.com/advisory/ntap-20241011-0001/