Skip to content
OpenAdvisories
Low ELSA-2025-0083 1 CVE

Low: cups security update (Oracle Linux 8)

Published Jan 9, 2025 · Updated Jan 9, 2025

Ecosystem: Oracle Linux

Summary

[1:2.2.6-62]
- RHEL-60338 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 8 cups 1:2.2.6-62.el8_10
Oracle Linux · 8 cups-client 1:2.2.6-62.el8_10
Oracle Linux · 8 cups-devel 1:2.2.6-62.el8_10
Oracle Linux · 8 cups-filesystem 1:2.2.6-62.el8_10
Oracle Linux · 8 cups-ipptool 1:2.2.6-62.el8_10
Oracle Linux · 8 cups-libs 1:2.2.6-62.el8_10
Oracle Linux · 8 cups-lpd 1:2.2.6-62.el8_10

Vulnerabilities 1

  • High 8.6
    CVE-2024-47175 Public exploit EPSS 64%

    libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

    CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other funct…

    OpenPrinting libppd cups cups Debian Ubuntu Alpine