CVE-2024-47076 libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server
Attackers can inject malicious data via unsanitized IPP attributes, potentially compromising the CUPS printing system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47076?
CVE-2024-47076 is a high-severity vulnerability in OpenPrinting libcupsfilters, published on 26 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.
Weakness: CWE-20
Which versions are affected by CVE-2024-47076?
It affects 1 product.
Products include Openprinting Libcupsfilters.
How do I fix CVE-2024-47076?
Apply the vendor's patch.
Is CVE-2024-47076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47076 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Sources
Also known as CLSA-2025-1745586793, CVE-2024-47177, DEBIAN-CVE-2024-47076, UBUNTU-CVE-2024-47076, USN-7044-1.