Skip to content
OpenAdvisories
Medium USN-6844-1 1 CVE

cups vulnerability

Published Jun 24, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Rory McNamara discovered that when starting the cupsd server with a
Listen configuration item, the cupsd process fails to validate if
bind call passed. An attacker could possibly trick cupsd to perform
an arbitrary chmod of the provided argument, providing world-writable
access to the target.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS cups 2.3.1-9ubuntu1.7
Ubuntu · 22.04 LTS 22.04:LTS cups 2.4.1op1-1ubuntu4.9
Ubuntu · 24.04 LTS 24.04:LTS cups 2.4.7-1.2ubuntu7.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS cups 2.1.3-4ubuntu0.11+esm6
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS cups 2.2.7-1ubuntu2.10+esm4

Vulnerabilities 1

  • Medium 4.4
    CVE-2024-35235

    Cupsd Listen arbitrary chmod 0140777

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-35235