Skip to content
OpenAdvisories
High ALAS2023-2024-718 1 CVE

Important: cups-filters security update (Amazon Linux 2023)

Published Sep 27, 2024 · Updated Oct 2, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47175: A flaw in cups-filters allows a remote unauthenticated client to create a PPD configuration file with code injection. If a job is sent to the compromised printer, the code is executed allowing for remote code execution.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 cups-filters 0:1.28.16-3.amzn2023.0.2
Amazon Linux · 2023 cups-filters-debuginfo 0:1.28.16-3.amzn2023.0.2
Amazon Linux · 2023 cups-filters-debugsource 0:1.28.16-3.amzn2023.0.2
Amazon Linux · 2023 cups-filters-devel 0:1.28.16-3.amzn2023.0.2
Amazon Linux · 2023 cups-filters-libs 0:1.28.16-3.amzn2023.0.2
Amazon Linux · 2023 cups-filters-libs-debuginfo 0:1.28.16-3.amzn2023.0.2

Vulnerabilities 1

  • High 8.6
    CVE-2024-47175 Public exploit EPSS 64%

    libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

    CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other funct…

    OpenPrinting libppd cups cups Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47175.html