Source: libcupsfilters Version: 2.0.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for libcupsfilters. CVE-2024-47076[0]: | CUPS is a standards-based, open-source printing system, and | `libcupsfilters` contains the code of the filters of the former | `cups-filters` package as library functions to be used for the data | format conversion tasks needed in Printer Applications. The | `cfGetPrinterAttributes5` function in `libcupsfilters` does not | sanitize IPP attributes returned from an IPP server. When these IPP | attributes are used, for instance, to generate a PPD file, this can | lead to attacker controlled data to be provided to the rest of the | CUPS system. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-47076 https://www.cve.org/CVERecord?id=CVE-2024-47076 [1] https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 [2] https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ [3] https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3d20c109332d14672a807353cdc551018 Regards, Salvatore
