CVE-2024-47175
ADVISORY - nistSummary
CUPS is a standards-based, open-source printing system, and libppd
can be used for legacy PPD file support. The libppd
function ppdCreatePPDFromIPP2
does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5
, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Common Weakness Enumeration (CWE)
Improper Input Validation
Improper Neutralization of Special Elements used in a Command ('Command Injection')
NIST
3.9
CVSS SCORE
8.6highAlpine
-
Debian
-
CVSS SCORE
N/AlowUbuntu
-
CVSS SCORE
N/AmediumAlma
-
CVSS SCORE
N/AlowAlma
-
CVSS SCORE
N/AlowAlma
-
CVSS SCORE
N/AhighAlma
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighRed Hat
2.2
CVSS SCORE
7.7highRocky
-
CVSS SCORE
N/AhighRocky
-
CVSS SCORE
N/AmediumRocky
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AlowOracle
-
CVSS SCORE
N/AlowOracle
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AhighPhoton
CVE-2024-47175
-
CVSS SCORE
8.6highintheWild
-
-