CVE-2024-47175CWE-20

libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

High · published September 26, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.6. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1
8.6
EPSS
64%
Percentile
99.2
In the wild
Unconfirmed
What it is

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.63607 · 99.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-09-26T21:18Z
EPSS history
Timeline
  • 26 SEP 21:18Z
    libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
    cvelistv5