CVE-2024-47175: Openprinting Libppd remote code execution (CVSS 8.6)

Description

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected products

Openprinting Libppd≤ 2.0.0 · 2.1

Debian Linux11.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8Not Applicable
https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47Not Applicable
https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5Not Applicable
https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477Patch
https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6ExploitVendor Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00047.htmlMailing List
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0016
https://security.netapp.com/advisory/ntap-20241011-0001/
https://www.cups.orgProduct
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-IExploitThird Party Advisory

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-47175 being actively exploited?

CVE-2024-47175 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 63.6%.

How severe is CVE-2024-47175?

CVE-2024-47175 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 63.6% probability of exploitation.

Which products are affected by CVE-2024-47175?

Affected products include Openprinting Libppd, Debian Linux.

How do I fix CVE-2024-47175?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-47175 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo