Detections
Analytics

CVE-2024-47175

critical

Description

CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.

From the Tenable Blog

CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Frequently Asked Questions About Common UNIX Printing System (CUPS) Vulnerabilities
CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Frequently Asked Questions About Common UNIX Printing System (CUPS) Vulnerabilities

Published: 2024-09-26

Frequently asked questions about multiple vulnerabilities in the Common UNIX Printing System (CUPS) that were disclosed as zero-days on September 26.

References

https://securitylabs.datadoghq.com/articles/emerging-vulnerability-cups/

https://www.darkreading.com/vulnerabilities-threats/emerging-threats-vulnerabilities-prepare-2025

https://cloud.google.com/support/bulletins/index#gcp-2024-056

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I

https://www.cups.org

https://lists.debian.org/debian-lts-announce/2024/09/msg00047.html

https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6

https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477

https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5

https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

http://www.openwall.com/lists/oss-security/2024/09/27/3

Details

Source: Mitre, NVD

Published: 2024-09-26

Updated: 2025-09-29

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.32456

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest