Threat Intelligence Database

The cups-filters package, formerly part of the core CUPS distribution and now maintained independently, has multiple security issues including a lack of sanitization in the cfGetPrinterAttributes API (CVE-2024-47076), a vulnerability in cups-browsed trusting any UDP packet on port 631, and a remote command injection vulnerability in libppd. These issues affect Red Hat Enterprise Linux 9 and related variants. Red Hat has issued a security advisory with updates to address these vulnerabilities.

A security advisory from Red Hat addresses multiple vulnerabilities in the cups-filters package, which contains components formerly part of the core CUPS printing system. Notably, CVE-2024-47076 involves the libcupsfilters `cfGetPrinterAttributes` API failing to sanitize returned IPP attributes. Other issues include cups-browsed trusting any UDP packet on port 631 and a remote command injection vulnerability in cups libppd via attacker-controlled PPD file data. Red Hat has released an important security update for Red Hat Enterprise Linux 8 to address these issues.

A security update for the cups-filters package addresses multiple vulnerabilities including an issue in the cfGetPrinterAttributes API that does not sanitize returned IPP attributes (CVE-2024-47076), a cups-browsed UDP binding trust issue, and a remote command injection vulnerability in cups libppd. These vulnerabilities affect Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The update is rated as Important by Red Hat Product Security and fixes these issues in version 1.28.7-11.el9_2.2 of cups-filters.