CVE coverage
View on NVD →
CVE-2024-47175
CVSS 8.6
5 detections found
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Network Connection by Cups or Foomatic-rip Child | production | 2026-09-18 |
| elastic | File Creation by Cups or Foomatic-rip Child | production | 2026-09-18 |
| elastic | Printer User (lp) Shell Execution | production | 2026-09-18 |
| elastic | Cupsd or Foomatic-rip Shell Execution | production | 2026-09-18 |
| elastic | Suspicious Execution from Foomatic-rip or Cupsd Parent | production | 2026-09-18 |