This vulnerability allows remote attackers to execute arbitrary code on affected installations of Lenovo Service Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-4696.
It was discovered that the Booth cluster ticket manager failed to
correctly validate some authentication hashes.
Albert Cervera discovered two missing authorisation checks in the Tryton
application platform.
cups-2.4.10-7.fc39
cups-browsed-2.0.1-3.fc39
libcupsfilters-2.1~b1-3.fc39
libppd-2.1~b1-2.fc39
Fix for remote vulnerabilities against OpenPrinting cups-filters
cups-2.4.10-7.fc40
cups-browsed-2.0.1-3.fc40
libcupsfilters-2.1~b1-3.fc40
libppd-2.1~b1-2.fc40
Fix for remote vulnerabilities against OpenPrinting cups-filters
cups-2.4.10-7.fc41
cups-browsed-2.0.1-3.fc41
libcupsfilters-2.1~b1-3.fc41
libppd-2.1~b1-2.fc41
Fix for remove vulnerabilities against OpenPrinting cups-filters
Simone Margaritelli discovered that libppd incorrectly sanitized IPP data
when creating PPD files. A remote attacker could possibly use this issue to
manipulate PPD files and execute arbitrary code when a printer is used.
Simone Margaritelli discovered that libcupsfilters incorrectly sanitized
IPP data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used.
Simone Margaritelli discovered that the cups-filters cups-browsed component
could be used to create arbitrary printers from outside the local network.
In combination with issues in other printing components, a remote attacker
could possibly use this issue to connect to a system, created manipulated
PPD files, and execute arbitrary code when a printer is used. This update
disables support for the legacy CUPS printer discovery protocol.
(CVE-2024-47176)
Simone Margaritelli discovered that cups-filters incorrectly sanitized IPP
data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used. (CVE-2024-47076)
Simone Margaritelli discovered that cups-browsed could be used to create
arbitrary printers from outside the local network. In combination with
issues in other printing components, a remote attacker could possibly use
this issue to connect to a system, created manipulated PPD files, and
execute arbitrary code when a printer is used. This update disables support
for the legacy CUPS printer discovery protocol.
