Red Hat Security Advisory

RHSA-2024:7506

cups-filters security update

Released 2024-10-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.0) cups-filters-1.28.7-10.el9_0.2, cups-filters-libs-1.28.7-10.el9_0.2

Fixes 4 records

TI-2024-31543 CVE-2024-47175

libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

HIGH 78

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.63607 Published 2024-09-26 Partial fix CWE-20

TI-2024-31458 CVE-2024-47076

libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server

HIGH 77

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks need…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.79896 Published 2024-09-26 Fixed CWE-20

TI-2024-32111 CVE-2024-47850 · GHSA-phc2-g348-384g

CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination…

HIGH 66

CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00853 Published 2024-10-04 Partial fix CWE-400

TI-2024-31544 CVE-2024-47176

cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

MEDIUM 57

CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.50605 Published 2024-09-26 Fixed CWE-1327