Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large (1) page or (2) line in a URF file.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0029 advisory.

    This advisory aggregates security fixes for the cups-filters SRPM in CIQ LTS 8.6. It addresses 9 CVEs:
    CVE-2023-24805, CVE-2024-47175, CVE-2013-6473, CVE-2013-6474, CVE-2013-6476, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0405 advisory.

    This advisory aggregates security fixes for the cups-filters SRPM in CIQ LTS 9.2. It addresses 9 CVEs:
    CVE-2023-24805, CVE-2024-47175, CVE-2013-6473, CVE-2013-6474, CVE-2013-6476, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated cups-filters packages fix security vulnerabilities :

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6473).

Florian Weimer discovered that cups-filters incorrectly handled memory in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6474, CVE-2013-6475).

Florian Weimer discovered that cups-filters did not restrict driver directories in in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user (CVE-2013-6476).

Sebastian Krahmer discovered it was possible to use malicious broadcast packets to execute arbitrary commands on a server running the cups-browsed daemon (CVE-2014-2707).

In cups-filters before 1.0.53, out-of-bounds accesses in the process_browse_data function when reading the packet variable could leading to a crash, thus resulting in a denial of service (CVE-2014-4337).

In cups-filters before 1.0.53, if there was only a single BrowseAllow line in cups-browsed.conf and its host specification was invalid, this was interpreted as if no BrowseAllow line had been specified, which resulted in it accepting browse packets from all hosts (CVE-2014-4338).

The CVE-2014-2707 issue with malicious broadcast packets, which had been fixed in Mageia Bug 13216 (MGASA-2014-0181), had not been completely fixed by that update. A more complete fix was implemented in cups-filters 1.0.53 (CVE-2014-4336).

Note that only systems that have enabled the affected feature by using the CreateIPPPrinterQueues configuration directive in /etc/cups/cups-browsed.conf were affected by the CVE-2014-2707 / CVE-2014-4336 issue.

The remote host is affected by the vulnerability described in GLSA-201406-16 (cups-filters: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cups-filters. Please       review the CVE identifiers referenced below for more details about the       vulnerabilities.
  Impact :

    A remote attacker(s) could possibly execute arbitrary code utilizing       multiple attack vectors, or a local attacker could gain escalated       privileges via a specially crafted shared library.
  Workaround :

    There is no known workaround at this time.

This update removes unused pdftoopvp and urftopdf filters.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. This issue only affected Ubuntu 13.10. (CVE-2013-6473)

Florian Weimer discovered that cups-filters incorrectly handled memory in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user.
(CVE-2013-6474, CVE-2013-6475)

Florian Weimer discovered that cups-filters did not restrict driver directories in in the pdftoopvp filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user. (CVE-2013-6476).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
357368	Rocky Linux 8.6 [CIQ] Security Update: cups-filters / cups-filters-debuginfo / cups-filters-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0029)	Nessus	Rocky Linux Local Security Checks	Local	critical
353597	Rocky Linux 9.2 [CIQ] Security Update: cups-filters / cups-filters-debuginfo / cups-filters-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0405)	Nessus	Rocky Linux Local Security Checks	Local	critical
82353	Mandriva Linux Security Advisory : cups-filters (MDVSA-2015:100)	Nessus	Mandriva Local Security Checks	Local	high
76084	GLSA-201406-16 : cups-filters: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
73044	Fedora 20 : cups-filters-1.0.41-5.fc20 (2014-3738)	Nessus	Fedora Local Security Checks	Local	medium
72978	Ubuntu 12.04 LTS / 12.10 / 13.10 : cups-filters vulnerabilities (USN-2143-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-6473

critical

Tenable Plugins

critical

critical

high

high

medium

medium