Vulnerabilities

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.

A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buffer overflow which can lead to a arbitrary code execution in a privileged service. To trigger the vulnerability, a malicious device would need to be connected to the vulnerable system over USB.

CVE-2024-47176 is a flaw in cups-browsed, the network printer auto-discovery component of the OpenPrinting CUPS printing stack shipped with most major Linux and Unix distributions, which binds to UDP port 631 on all interfaces (INADDR_ANY) and therefore accepts and trusts unauthenticated packets from any source. A remote attacker can send a crafted browse/IPP packet that makes cups-browsed issue a Get-Printer-Attributes IPP request to an attacker-controlled URL. On its own this flaw is rated Medium (5.3), but chained with companion flaws in libcupsfilters (CVE-2024-47076), libppd (CVE-2024-47175), and cups-filters (CVE-2024-47177) it enables unauthenticated arbitrary command execution when a user prints to the attacker's malicious printer; the exposure has also been noted as abusable for DDoS amplification. Any Linux/Unix system running cups-browsed with UDP/631 reachable from an untrusted network is affected. No confirmed widespread in-the-wild exploitation has been reported and the flaw is not yet in CISA's KEV, but public proofs of concept exist and EPSS assigns a ~51% probability of exploitation within 30 days (99th percentile).

Do: Update cups-browsed and the companion cups-filters/libcupsfilters/libppd packages to the patched releases published by OpenPrinting and your distribution alongside the September 2024 advisories (see GHSA-rj88-6mr5-rcw8). If patched packages are not yet available, stop or disable the cups-browsed service, or firewall inbound UDP port 631 from untrusted networks and ensure it binds only to localhost where network printer discovery is not needed. Audit whether cups-browsed is running and whether UDP/631 is reachable from the internet, and treat any network-reachable CUPS host as a candidate for the full RCE chain.

CVE-2024-47175 is an improper input validation flaw (CWE-20) in OpenPrinting's libppd: the ppdCreatePPDFromIPP2 function fails to sanitize IPP attributes when writing them into a generated PPD buffer. When this unsanitized, attacker-controlled input flows through the CUPS print pipeline — for example via the cups-browsed entry point abused in CVE-2024-47176, in combination with functions such as cfGetPrinterAttributes5 — it can ultimately be executed by Foomatic print filters, giving remote code execution. Affected systems are Linux/Unix hosts running the CUPS printing stack with vulnerable libppd components, which includes widely used distributions such as Debian and, per press coverage, most other major Linux distros. Exploitation status: public proofs of concept and researcher write-ups exist, the flaw carries a high EPSS score (63.6% probability of exploitation within 30 days, 99th percentile) and warnings about abuse including DDoS, but it is not yet in CISA's KEV catalog, so no confirmed widespread in-the-wild exploitation is documented in the available data.

Do: Install your distribution's security updates — upgrade libppd to the patched release (2.1b1 or later, per the OpenPrinting advisory GHSA-7xfx-47qg-grp6) and apply the matching cups/cups-filters fixes. As interim mitigation, disable or stop cups-browsed if not needed and block or restrict inbound UDP 631 (and IPP/port 631 generally) from untrusted networks, particularly on internet-facing hosts. Check whether CUPS is running and reachable on your systems and whether configured printers rely on Foomatic filters, which the RCE chain requires.

OpenPrinting's libcupsfilters, the library providing CUPS filter functionality for printer data-format conversion, fails to sanitize IPP attributes returned from IPP servers in its cfGetPrinterAttributes5 function (CWE-20, CVSS 8.6). The flaw is triggered when a system running CUPS contacts an attacker-controlled or untrusted IPP server and uses the returned attributes, for example to generate a PPD file, allowing attacker-controlled data to flow into the rest of the CUPS system. On its own this yields high-integrity attacker data injection (per the CVSS vector, no direct confidentiality or availability loss), but it is one of several CUPS flaws disclosed together in late September 2024 that, when chained under certain conditions, can result in remote code execution on Linux and Unix systems. Any system running libcupsfilters is affected; CUPS and its filter libraries ship by default with most major Linux distributions, and public internet scans around disclosure found roughly 75,000 hosts exposing the IPP service (TCP 631) directly to the internet. Proof-of-concept details are public (an EvilSocket writeup and the OpenPrinting GitHub advisory GHSA-w63j-6g73-wmg5), the flaw is not yet in CISA KEV, and EPSS assigns a 77.6% probability of exploitation within 30 days, though no confirmed in-the-wild exploitation appears in the provided data.

Do: Upgrade libcupsfilters to the patched release identified in the OpenPrinting advisory GHSA-w63j-6g73-wmg5 (fixed in libcupsfilters 2.1.0), applying your distribution's updated cups-filters/CUPS packages; also install the companion CUPS component fixes released the same week, since this flaw is typically chained with other CUPS bugs (notably in cups-browsed) for remote code execution. Until patched, restrict or disable exposure of the IPP service (TCP 631) to untrusted networks and avoid creating or refreshing printer queues from untrusted or mDNS-advertised IPP servers.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue.

cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of `scanf(3)`. cpdb-libs uses the `fscanf()` and `scanf()` functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by `fscanf()` and `scanf()` causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of `%s` with `%1023s` in all calls of the `fscanf()` and `scanf()` functions.

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication.

A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.