RHSA-2024:7553 — Security Advisory

An update for cups-filters is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently.

Security Fix(es):

• cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source (CVE-2024-47176)

• cups-filters: libcupsfilters: cfGetPrinterAttributes API does not perform sanitization on returned IPP attributes (CVE-2024-47076)

• cups: libppd: remote command injection via attacker controlled data in PPD file (CVE-2024-47175)

• cups-browsed: cups-filters: cups-browsed vulnerable to DDoS amplification attack (CVE-2024-47850)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.