Improper Input Validation Affecting OpenPrinting/libcupsfilters package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-OPENPRINTINGLIBCUPSFILTERS-8102332
- published 27 Sep 2024
- disclosed 26 Sep 2024
- credit Simone Margaritelli
Introduced: 26 Sep 2024
CVE-2024-47076 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Improper Input Validation via the cfGetPrinterAttributes5 function due to improper sanitization of IPP attributes returned from an IPP server. An attacker can manipulate the data processed by this function by injecting malicious IPP attributes, which are not properly sanitized before use. This can lead to the generation of incorrect or harmful outputs within the CUPS system.
Note: This vulnerability is being investigated and the advisory is being updated as new information is discovered.
PoC
This bug is part of an exploit chain leading to RCE described here.