Threats Tagged 'cve-2024-47850'

CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)

HighVulnerabilityUnited StatesGermanyJapan+7#cve#cve-2024-47850

A security update for the cups-filters package in Red Hat Enterprise Linux 7.7 addresses multiple vulnerabilities including an unsanitized IPP attribute issue in the cfGetPrinterAttributes API (CVE-2024-47076), a cups-browsed UDP binding trust issue, and a remote command injection via PPD file in cups libppd. These vulnerabilities could allow attackers to exploit the printing system components. Red Hat has released updated packages to fix these issues.

A security update for the cups-filters package in Red Hat Enterprise Linux 9.2 addresses multiple vulnerabilities including CVE-2024-47076, where the cfGetPrinterAttributes API does not sanitize returned IPP attributes. Other issues fixed include a cups-browsed UDP binding vulnerability and a remote command injection in the cups libppd component. These vulnerabilities could allow attackers to exploit unsanitized inputs or trust packets from any source. The update is rated as Important by Red Hat Product Security and affects several Red Hat Enterprise Linux 9.2 variants and architectures.

Multiple security vulnerabilities have been identified in the cups-filters package used in Red Hat Enterprise Linux versions 7 and 8.6. Notably, the libcupsfilters cfGetPrinterAttributes API does not sanitize returned IPP attributes (CVE-2024-47076), which could lead to security issues. Additional vulnerabilities include remote command injection via attacker-controlled data in PPD files and a DDoS amplification attack vector in cups-browsed. Red Hat has released security updates addressing these issues for affected versions.

A security update for the cups-filters package in Red Hat Enterprise Linux 8 addresses multiple vulnerabilities, including CVE-2024-47076 where the cfGetPrinterAttributes API does not sanitize returned IPP attributes. Other issues fixed include cups-browsed binding on UDP INADDR_ANY:631 trusting any packet and a remote command injection vulnerability in cups libppd. These vulnerabilities could lead to security risks if exploited. The update is rated as Important by Red Hat and patches are available for affected versions.

A security update for the cups-filters package in Red Hat Enterprise Linux 8.8 addresses multiple vulnerabilities including an issue in the cfGetPrinterAttributes API that does not sanitize returned IPP attributes (CVE-2024-47076). Other related issues include cups-browsed binding on UDP INADDR_ANY:631 without source validation and a remote command injection vulnerability in cups libppd. These vulnerabilities have been rated as important by Red Hat Product Security and affect various Red Hat Enterprise Linux 8.8 Extended Update Support and Extended Life Cycle Long Life versions.

A security update for the cups-filters package in Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including an unsanitized IPP attribute issue in the cfGetPrinterAttributes API (CVE-2024-47076), a cups-browsed UDP binding issue, and a remote command injection vulnerability in the cups libppd component. These issues could allow attackers to exploit the printing system components. The update is rated as important by Red Hat and patches are available for affected versions.