Description
The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.3.8-1lenny2 | — |
| Debian 13 | cups | 1.3.8-1lenny2 | — |
| Debian 12 | cups | 1.3.8-1lenny2 | — |
| Debian 4.0 | cupsys | 1.2.7-4etch5 | DSA-1656-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cups +3 | 1:1.2.4-11.18.el5_2.2 | RHSA-2008:0937 |
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.27.el4_7.1 | RHSA-2008:0937 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.54 | RHSA-2008:0937 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.3.3op2-4.2 | openSUSE-SU-2024:10707-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- CUPS 1.3.7 - 'HP-GL/2' Filter Remote Code Execution EDB-32470 · remote · Oct 9, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2008:0937 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1656-1 cupsys - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10707-1 cups-2.3.3op2-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 261088 vendor-advisory
- 32284 third-party-advisory
- MDVSA-2008:211 vendor-advisory
- ADV-2008-2782 vdb-entry
- GLSA-200812-11 vendor-advisory
- 32331 third-party-advisory
- 31681 vdb-entry
- cups-hpgl-code-execution(45779) vdb-entry
- 33111 third-party-advisory
- oval:org.mitre.oval:def:9666 vdb-entry signature
- 32292 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-067
- ADV-2009-1568 vdb-entry
- FEDORA-2008-8844 vendor-advisory
- FEDORA-2008-8801 vendor-advisory
- SUSE-SR:2008:021 vendor-advisory
- 33085 third-party-advisory
- SUSE-SR:2009:002 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-470.htm
- 33568 third-party-advisory
- ADV-2008-3401 vdb-entry
- 31688 vdb-entry
- 32222 third-party-advisory
- 32226 third-party-advisory
- DSA-1656 vendor-advisory
- http://www.cups.org/str.php?L2911
- 1021031 vdb-entry
- USN-656-1 vendor-advisory
- ADV-2008-2780 vdb-entry
- http://www.cups.org/articles.php?L575
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- 32084 third-party-advisory
- RHSA-2008:0937 vendor-advisory
- 32316 third-party-advisory
- 20081010 ZDI-08-067: Apple CUPS 1.3.7 (HP-GL/2 filter) Remote Code Execution Vulnerability mailing-list