OpenPrinting libppd vulnerabilities

Latest OpenPrinting libppd CVEs

Newest publication first

1. CVE-2024-47175 libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

   Published 2024-09-26

   Critical·CVSS 9.8 EPSS 63.6% Framework module

   CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAt...

2. CVE-2023-4504 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

   Published 2023-09-21

   High·CVSS 7.0

   Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.