CVE-2024-47175 libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
Attackers can achieve remote code execution via Foomatic by exploiting unsanitized IPP attributes in libppd's PPD buffer creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47175?
CVE-2024-47175 is a high-severity code injection vulnerability in Debian Debian Linux, published on 26 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Weakness: CWE-20
Which versions are affected by CVE-2024-47175?
It affects 2 products.
Linux distribution packages (40)
cups AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups-client AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups-devel AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups-filesystem AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups-ipptool AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups-libs AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups-lpd AlmaLinux:8 | All versions | 1:2.2.6-62.el8_10 |
cups AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-client AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-devel AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-filesystem AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-ipptool AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-libs AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-lpd AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups-printerapp AlmaLinux:9 | All versions | 1:2.3.3op2-31.el9_5 |
cups Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-client Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-client-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-devel Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-filesystem Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-ipptool Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-ipptool-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-lpd Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups-lpd-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.2.6-62.el8_10 |
cups Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-client-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-ipptool-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-libs Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups-lpd-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:2.2.6-62.el8_10 |
cups Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-31.el9_5 |
cups-client Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-31.el9_5 |
cups-client-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-31.el9_5 |
cups-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-31.el9_5 |
cups-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:2.3.3op2-31.el9_5 |
Products include Debian Debian Linux, Openprinting Libppd.
How do I fix CVE-2024-47175?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-47175 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47175 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2024-47175, ALSA-2024:9470, ALSA-2025:0083, BELL-CVE-2024-47175, CLSA-2025-1741215440, CLSA-2025-1741215546 and 22 more.