CVE-2024-47175

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
OpenPrinting	libppd	<= 2.1b1
openprinting	libppd	<= 2.1b1

References

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8Not Applicable
https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47Not Applicable
https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5Not Applicable
https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6Exploit, Vendor Advisory
https://www.cups.orgProduct
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-IExploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/3Mailing List
https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477Patch
https://lists.debian.org/debian-lts-announce/2024/09/msg00047.htmlMailing List
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0016
https://security.netapp.com/advisory/ntap-20241011-0001/

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-471765.3CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limite CVE-2024-471785.3basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison CVE-2024-471798.8RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning, which could CVE-2024-47186.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is a CVE-2024-471808.8Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own in CVE-2024-471817.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL im CVE-2024-471827.5Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves us CVE-2024-471838.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCust CVE-2024-471844.8Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerabl CVE-2024-471866.1Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by CVE-2024-471877.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7 CVE-2024-471887.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7