CVE-2024-47175
Publication date 6 October 2024
Last updated 7 October 2024
Ubuntu priority
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cups | 24.04 LTS noble |
Fixed 2.4.7-1.2ubuntu7.3
|
| 22.04 LTS jammy |
Fixed 2.4.1op1-1ubuntu4.11
|
|
| 20.04 LTS focal |
Fixed 2.3.1-9ubuntu1.9
|
|
| 18.04 LTS bionic |
Fixed 2.2.7-1ubuntu2.10+esm6
|
|
| 16.04 LTS xenial |
Fixed 2.1.3-4ubuntu0.11+esm8
|
|
| libppd | 24.04 LTS noble |
Fixed 2:2.0.0-0ubuntu4.1
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProReferences
Related Ubuntu Security Notices (USN)
- USN-7041-1
- CUPS vulnerability
- 26 September 2024
- USN-7045-1
- libppd vulnerability
- 26 September 2024
- USN-7041-2
- CUPS vulnerability
- 1 October 2024
- USN-7041-3
- CUPS vulnerability
- 7 October 2024