Skip to content
OpenAdvisories
High RHSA-2024:7553 4 CVEs

Red Hat Security Advisory: cups-filters security update

Published Oct 3, 2024 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 cups-filters 0:1.0.35-29.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7 cups-filters-debuginfo 0:1.0.35-29.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7 cups-filters-devel 0:1.0.35-29.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7 cups-filters-libs 0:1.0.35-29.el7_9.3

Vulnerabilities 4

  • High 8.6
    CVE-2024-47076 Public exploit EPSS 80%

    libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server

    CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetP…

    OpenPrinting libcupsfilters cups-filters cups-filters Debian Ubuntu
  • High 8.6
    CVE-2024-47175 Public exploit EPSS 64%

    libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

    CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other funct…

    OpenPrinting libppd cups cups Debian Ubuntu Alpine
  • High 7.5
    CVE-2024-47850

    CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a sin…

    cups cups-filters cups-filters cups-browsed Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2024-47176 Public exploit Scanner template EPSS 51%

    cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

    CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trus…

    OpenPrinting cups-browsed cups-filters cups-filters Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2314252
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2314253
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2314256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2316417
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7553.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-47076
  • article
    https://access.redhat.com/security/vulnerabilities/RHSB-2024-002
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47076
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47076
  • article
    https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5/
  • article
    https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
  • report
    https://access.redhat.com/security/cve/CVE-2024-47175
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47175
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47175
  • article
    https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
  • report
    https://access.redhat.com/security/cve/CVE-2024-47176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47176
  • article
    https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
  • report
    https://access.redhat.com/security/cve/CVE-2024-47850
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-47850
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-47850
  • article
    https://github.com/OpenPrinting/cups
  • article
    https://www.akamai.com/blog/security-research/october-cups-ddos-threat