Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.
Null Pointer Dereference vulnerability in the ippreadio() function of the CUPS printing system. The flaw is caused by unsafe deserialization and improper validation of crafted printer attribute responses. When ippValidateAttributes() processes such responses, a null pointer dereference occurs, leading to application crash. This issue can be exploited remotely within the local subnet in default configurations, and in some cases over the network if IPP services are exposed. Exploitation requires no authentication or user interaction, allowing attackers to disrupt availability of printing services on affected systems.
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function.
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.
Description of problem: rpmbuild cannot apply cups-CVE-2008-3640.patch due to the patch corruption.
Version-Release number of selected component (if applicable): cups-1.1.17-13.3.54.src.rpm cups-1.1.17-13.3.55.src.rpm
How reproducible: always
Steps to Reproduce: 1. rpm -i cups-1.1.17-13.3.54.src.rpm 2. rpmbuild -bp /usr/src/redhat/SPEC/cups.spec Actual results: error: File /usr/src/redhat/SOURCES/cups-CVE-2008-3640.patch is smaller than 4 bytes
Expected results: Unpack the sources and apply the patch.
Additional info:
CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.
CUPS 1.3.x and earlier ships setuid binaries which use environment variables to set the directories in which they operate.
Description of problem: CVE-2009-3553 (bug #530111) has not been completely fixed.
Version-Release number of selected component (if applicable): Versions known to be affected:
cups-1.3.7-11.el54.5 (RHEL-5.4.z) cups-1.3.7-16.el5 (RHEL-5)
Additional info: The cause is that the cupsdDoSelect() function uses one of several implementations depending on the underlying select/poll capabilities of the operating system. For kqueue and epoll implementations, cupsdRemoveSelect() does not immediately decrease the reference count for the file descriptor and instead adds it to the cupsdinactivefds array. File descriptors in that array are finally dereferenced in cupsdStopSelect() (i.e. program termination).
In Red Hat Enterprise Linux, the epoll implementation is used.
The previous fix for CVE-2009-3553 was to check that another reference was held for the file descriptor before calling the writecb function; however, that will always be the case for both the epoll and kqueue implementations.
The correct fix is to check whether the file descriptor is in the cupsdinactivefds array before calling the writecb function.
Alan Coopersmith <alan.coopersmith () oracle com> writes: https://heyitsas.im/posts/cups/ discloses: [...] Hopefully not too off-topic but a related issue with CUPS is that it's incredibly difficult to remove in order to harden a system. Under Ubuntu it's installed by default and deeply embedded into things (some packages can't be removed at all, try a 'sudo apt purge libcups' but whatever you do don't hit 'y'), and keeps re-enabling and re-installing itself via different mechanisms (release-upgrade, snap, etc) once removed. So the easy mitigation of "don't do that, then" isn't really available unless you're prepared to spend some time recursively removing, disabling, and locking out everything involved.
Peter.
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than <a href="https://access.redhat.com/security/cve/CVE-2024-47176">CVE-2024-47176</a>. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
Accounts. A permissions issue was addressed with additional restrictions.
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.
A buffer overflow vulnerability in the function |formatlogline| could allow remote attackers to cause a denial-of-service(DoS) on the affected system (not verified for possible arbitrary code execution). Exploitation of the vulnerability can be triggered when the configuration file |cupsd.conf| sets the value of |loglevel |to |DEBUG|.
Last updated 25 August 2025
A localhost.localdomain whitelist entry in validhost() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
On 9/26/24 6:11 PM, Solar Designer wrote: CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDRANY:631 trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker controlled URL. This seems like a plausible and precise description for a vulnerability. <https://github.com/CVEProject/cvelistV5/blob/07723f33d3792d747b650a873346400ca5dc2034/cves/2024/47xxx/CVE-2024-47176.json#L15> and several unrelated CWEs are listed. <https://cve.mitre.org/cve/listrulesandguidance/countingrules.html>
-- Will Dormann | Senior Vulnerability Analyst
ANALYGENCE, Inc. 8115 Maple Lawn Blvd., Suite 110, Fulton, MD 20759 t 412.818.3452 | f 301.812.4252 e will.dormann () analygence com | w analygence.com
On Thu, Sep 26, 2024 at 03:43:23PM -0700, Alan Coopersmith wrote: On 9/26/24 15:11, Solar Designer wrote: A lot of drama around the disclosure of those issues was going on for maybe a month now, with public tweets about the disclosure process and the issues affecting many distros but excluding detail on the issues (not even CUPS was specifically mentioned until very recently). Per those tweets, the issues were communicated to some distro vendors via CERT/CC VINCE and a vendor planned to bring them to the distros list on September 30 with public disclosure on October 6. Unfortunately, the information leaked prematurely and thus Simone decided on full public disclosure today at 20:00 UTC pre-announcing it only 2 hours in advance. Once it was learned that the information was leaked, the vendors suggested ending the embargo today, and both evilsocket & OpenPrinting agreed to it, with the coordinated end at 20:00 UTC. Thanks Alan! On Twitter, Alan further clarified that "once it was clear the info was out there, the distro makers wanted to end the embargo so they could publish advisories telling users to disable cups-browsed instead of waiting for patches to be available - those with VINCE access had hours of prior notice, not just two."
I apologize to Simone for the unnecessary and wrong guess on whose decision it was. I didn't have that information and shouldn't have included a guess. OpenPrinting has started publishing fixes as well now:
CVE-2024-47175: https://github.com/OpenPrinting/libppd/commit/d681747ebf CVE-2024-47076: https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3
and a temporary workaround for CVE-2024-47176 in: https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c Thanks. I guess also this from a few days ago? -
https://github.com/OpenPrinting/cups/commit/8361420cbbfa2e729545c4c537c49fc6322c9631
"Escape localized strings in PPDs", which is similar to the last hunk in "Prevent PPD generation based on invalid IPP response" CVE-2024-47175 libppd commit referenced by Alan above.
Possibly unrelated to today's disclosure but also security-relevant is:
https://github.com/OpenPrinting/cups/commit/e3467edf3be2d20a022495d9726a741e36768caf
"Update httpConnectURI to do X.509 pinning, and use it when doing the IPP"
Zdenek, I hope you will soon clarify which commits fix what issues, to assist with distro backports. I understand you're still busy getting these in now and it's probably night time for you, so follow up when you have a moment later, please.
Thanks,
Alexander
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
Description of problem:
SUSE-SR:2007:014 (see URL field) reads:
- cups denial of service regression fix
CUPS packages were released to fix another denial of service problem introduced by the previous Denial of Service Fix for CVE-2007-0720, which was incomplete.
Version-Release number of selected component (if applicable):
CVE-2007-4045 Affects: RHEL4 CVE-2007-4045 Affects: RHEL5 CVE-2007-4045 Affects: FC6 CVE-2007-4045 Affects: FC7
Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.
Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
Aaron Sigel of Apple Product Security reported that CUPS did not check Host: HTTP header in the connections to the daemon. This insufficient checking may be of an advantage as part of some other attack, e.g. DNS rebinding attack (however, for such attack, user's web browser or browser plugin must be prone to the DNS rebinding attack).
Upstream patch adds check for the Host: header used in clients' requests. It also introduced ServerAlias configuration directive, that must be used to allow clients to use additional valid host names besides those set has hostname or hostname's aliases.
Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
Multiple integer overflows and one integer signedness error were found in the JBIG2 decoder. An attacker could use these flaws to cause a denial of service (application crash) via specially-crafted PDF file.
Acknowledgements:
Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting these flaws.
A security flaw was found in the JBIG2 decoder (possibility of freeing of uninitialized memory). An attacker could use this flaw to potentially cause a denial of service (application crash).
Acknowledgements:
Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting this flaw.
Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
An integer overflow flaw, leading to a heap-based buffer overflow, was discovered in the Tagged Image File Format (TIFF) decoding routines used by the CUPS image-converting filters, "imagetops" and "imagetoraster". An attacker could create a malicious TIFF file that could, potentially, execute arbitrary code as the "lp" user if the file was printed.
Acknowledgements:
Red Hat would like to thank Aaron Sigel of the Apple Product Security team and iDefense for responsibly reporting this flaw.
Sauli Pahlman of CERT-FI provided us with fuzzed PDF file which causes xpdf / poppler PDF parser to crash.
The crash is caused by an attempt to dereference uninitialized Gfx::parser pointer in Gfx::getPos(), which assumes parser is either NULL or valid Parser pointer.
http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Gfx.cc?id=71063d51#n879