Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenPrinting | cups | <= 2.4.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 2.4.7-2 | — |
| Debian 13 | cups | 2.4.7-2 | — |
| Debian 12 | cups | 2.4.2-3+deb12u6 | — |
| Debian 10 | cups | 2.2.10-6+deb10u10 | DLA-3826-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | cups | 2.4.7-1.2ubuntu7.1 | USN-6844-1 |
| Ubuntu 22.04 LTS | cups | 2.4.1op1-1ubuntu4.9 | USN-6844-1 |
| Ubuntu 20.04 LTS | cups | 2.3.1-9ubuntu1.7 | USN-6844-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | cups | 2.2.7-1ubuntu2.10+esm4 | USN-6844-1 |
| Ubuntu Pro 16.04 LTS | cups | 2.1.3-4ubuntu0.11+esm6 | USN-6844-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | cups +7 | 1:2.3.3op2-27.el9_4 | RHSA-2024:4776 |
| RHEL 8 | cups +6 | 1:2.2.6-60.el8_10 | RHSA-2024:4265 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | cups +7 | 1:2.3.3op2-16.el9_2.2 | RHSA-2024:5644 |
| RHEL 8.8 EUS | cups +6 | 1:2.2.6-51.el8_8.4 | RHSA-2024:4580 |
| RHEL 8.6 TUS | cups +6 | 1:2.2.6-45.el8_6.5 | RHSA-2024:4715 |
| RHEL 8.6 E4S | cups +6 | 1:2.2.6-45.el8_6.5 | RHSA-2024:4715 |
| RHEL 8.6 AUS | cups +6 | 1:2.2.6-45.el8_6.5 | RHSA-2024:4715 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | cups +7 | 1:2.3.3op2-27.el9_4 | ALSA-2024:4776 |
| AlmaLinux 8 | cups +6 | 1:2.2.6-60.el8_10 | ALSA-2024:4265 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | cups | 1:2.2.6-60.el8_10 | RLSA-2024:4265 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES 15 SP5 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES 15 SP4 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES 15 SP3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES 15 SP2 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | cups | 1.7.5-20.49.1 | SUSE-SU-2024:2002-1 |
| SLES for SAP 15 SP4 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES for SAP 15 SP3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES for SAP 15 SP2 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLES for SAP 12 SP5 | cups | 1.7.5-20.49.1 | SUSE-SU-2024:2002-1 |
| SLE Micro 6.0 | cups | 2.4.11-1.1 | SUSE-SU-2025:20090-1 |
| SLE Micro 5.5 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-2, SUSE-SU-2024:2003-1 |
| SLE Micro 5.4 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLE Micro 5.3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLE Micro 5.2 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLE HPC 15 SP4 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLE HPC 15 SP3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SLE HPC 15 SP2 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SUSE Manager Server 4.3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SUSE Manager Proxy 4.3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| SUSE Enterprise Storage 7.1 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.4.8-1.1 | openSUSE-SU-2024:14041-1 |
| openSUSE Leap 15.6 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| openSUSE Leap 15.5 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
| openSUSE Leap Micro 5.3 | cups | 2.2.7-150000.3.59.1 | SUSE-SU-2024:2003-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | cups | 2.4.9-r0 | — |
| Alpine v3.23 | cups | 2.4.9-r0 | — |
| Alpine v3.22 | cups | 2.4.9-r0 | — |
| Alpine v3.21 | cups | 2.4.9-r0 | — |
| Alpine v3.20 | cups | 2.4.9-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | cups | 2.4.9-r0 | — |
| Alpine v3.18 | cups | 2.4.9-r0 | — |
| Alpine v3.17 | cups | 2.4.9-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | cups +7 | 1:2.3.3op2-18.amzn2023.0.8 | ALAS2023-2024-660 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cups | 2.4.10-1 | — |
| Azure Linux 2 (CBL-Mariner) | cups | 2.3.3op2-9 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | cups +7 | 1:2.3.3op2-27.el9_4 | ELSA-2024-4776 |
| Oracle Linux 8 | cups +6 | 1:2.2.6-60.el8_10 | ELSA-2024-4265 |
Advisories 20
- ALSA-2024:4776 Moderate: cups security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:4265 Moderate: cups security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:4715 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:4776 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:4265 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:4580 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:5644 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-6844-1 cups vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2025:20090-1 Security update for cups SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3826-1 cups - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14041-1 cups-2.4.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2003-2 Security update for cups SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2003-1 Security update for cups SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2002-1 Security update for cups SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0225 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2025
- WID-SEC-2024-1369 CUPS: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jun 3, 2025
- RLSA-2024:4265 Moderate: cups security update Rocky Linux Security Advisories · May 7, 2025
- ELSA-2024-4776 Moderate: cups security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 23, 2024
- ALAS2023-2024-660 Moderate: cups security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 22, 2024
- ELSA-2024-4265 Moderate: cups security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 2, 2024
References
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
- https://github.com/OpenPrinting/cups/commit/ff1f8a623e090dee8a8aadf12a6a4b25efac143d
- https://git.launchpad.net/ubuntu/+source/apparmor/tree/profiles/apparmor.d/abstractions/user-tmp#n21
- https://github.com/OpenPrinting/cups/blob/aba917003c8de55e5bf85010f0ecf1f1ddd1408e/cups/http-addr.c#L229-L240
- http://www.openwall.com/lists/oss-security/2024/06/11/1
- http://www.openwall.com/lists/oss-security/2024/06/12/4
- http://www.openwall.com/lists/oss-security/2024/06/12/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00001.html