Skip to content
OpenAdvisories
Low ELSA-2024-9470 1 CVE

Low: cups security update (Oracle Linux 9)

Published Nov 20, 2024 · Updated Nov 20, 2024

Ecosystem: Oracle Linux

Summary

[1:2.3.3op2-31]
- RHEL-60343 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 9 cups 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-client 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-devel 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-filesystem 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-ipptool 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-libs 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-lpd 1:2.3.3op2-31.el9_5
Oracle Linux · 9 cups-printerapp 1:2.3.3op2-31.el9_5

Vulnerabilities 1

  • High 8.6
    CVE-2024-47175 Public exploit EPSS 64%

    libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

    CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other funct…

    OpenPrinting libppd cups cups Debian Ubuntu Alpine