CVE-2024-47175

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.

• CWE-20

• https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8Not Applicable
• https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47Not Applicable
• https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5Not Applicable
• https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6Exploit, Vendor Advisory
• https://www.cups.orgProduct
• https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-IExploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/09/27/3Mailing List
• https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477Patch
• https://lists.debian.org/debian-lts-announce/2024/09/msg00047.htmlMailing List
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0016
• https://security.netapp.com/advisory/ntap-20241011-0001/

Published

Sep 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4717A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-47170Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3
• CVE-2024-47171Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3
• CVE-2024-47172Computer Vision Annotation Tool (CVAT) is an interactive vid…5.4
• CVE-2024-47173Aimeos is an e-commerce framework. All SaaS and marketplace …5.5
• CVE-2024-47174Nix is a package manager for Linux and other Unix systems. S…5.9
• CVE-2024-47176CUPS is a standards-based, open-source printing system, and …5.3
• CVE-2024-47177Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-47178basic-auth-connect is Connect's Basic Auth middleware in its…5.3
• CVE-2024-47179RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's …8.8
• CVE-2024-4718A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-47180Shields.io is a service for concise, consistent, and legible…8.8