Advisories ยป MGASA-2024-0327

Updated cups & cups-filters packages fix security vulnerabilities

Publication date: 07 Oct 2024
Modification date: 07 Oct 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-47076 , CVE-2024-47175 , CVE-2024-47176 , CVE-2024-47177

Description

The `cfGetPrinterAttributes5` function in `libcupsfilters` does not
sanitize IPP attributes returned from an IPP server. When these IPP
attributes are used, for instance, to generate a PPD file, this can lead
to attacker controlled data to be provided to the rest of the CUPS
system. (CVE-2024-47076)
The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP
attributes when creating the PPD buffer. When used in combination with
other functions such as `cfGetPrinterAttributes5`, can result in user
controlled input and ultimately code execution via Foomatic. This
vulnerability can be part of an exploit chain leading to remote code
execution (RCE), as described in CVE-2024-47176. (CVE-2024-47175)
`cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet
from any source, and can cause the `Get-Printer-Attributes` IPP request
to an attacker controlled URL. When combined with other vulnerabilities,
such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker
can execute arbitrary commands remotely on the target machine without
authentication when a malicious printer is printed to. (CVE-2024-47176)
Any value passed to `FoomaticRIPCommandLine` via a PPD file will be
executed as a user controlled command. When combined with other logic
bugs as described in CVE_2024-47176, this can lead to remote command
execution. (CVE-2024-47177)

References

SRPMS

9/core