CUPS vulnerabilities

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.

Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.

Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior.

This CVE was rejected as not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

The cupsUTF32ToUTF8() function in CUPS (cups/transcode.c) lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

OpenPrinting CUPS prior to 2.4.17 allows a network-adjacent attacker to send a crafted SNMP response to the CUPS SNMP backend, causing an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This is fixed in 2.4.17.

OpenPrinting CUPS versions 2.4.16 and earlier contain a vulnerability that allows a local unprivileged user to coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable `Authorization: Local ...` token. This token enables /admin/ requests on localhost, and the attacker can create a persistent printer queue with a file:///... URI despite the FileDevice policy. Printing to that queue allows arbitrary root file overwrite, potentially leading to privilege escalation.

OpenPrinting CUPS versions 2.4.16 and prior have a vulnerability in a network-exposed cupsd with a shared PostScript queue. An unauthenticated client can send a print job, and the server processes a page-border value with an embedded newline, allowing execution of an arbitrary binary (e.g., /usr/bin/vim) as user lp.

OpenPrinting CUPS up to version 2.4.16 has a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attributes. At the time of publication, no public patches are available.

In OpenPrinting CUPS versions 2.4.16 and prior, the RSS notifier allows path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to any lp-writable location. By exploiting default group-writable permissions (root:lp, mode 0770), the notifier running as lp can overwrite root-managed state files, causing job cache parsing failures and loss of queued jobs after cupsd restart.

OpenPrinting CUPS versions 2.4.16 and prior contain an authorization bypass vulnerability due to case-insensitive username comparison. This allows an unprivileged user to gain unauthorized access to restricted operations by using a username that differs only in case from an authorized user. No public patches are available at the time of publication.

Incorrect default permissions vulnerability in the cups package of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory. Local attackers with control of the lp users can create files as root with 0644 permissions without the ability to set the content.