SUSE-SU-2024:3570-1

Details

Description of the patch:

This update for cups-filters fixes the following issues:

CVE-2024-47176: cups-browsed binds on UDP port 631 and trusts packets that try to trigger a Get-Printer-Attributes IPP request. (bsc#1230939)
CVE-2024-47850: cups-browsed can be abused to initiate remote DDoS against third-party targets (bsc#1231294)

The fix is disabling the CUPS protocol in cups-browsed.

Affected Packages(13 packages)

cups-filters

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

cups-filters-cups-browsed

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

cups-filters-foomatic-rip

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

cups-filters-ghostscript

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

libpoppler-glib8

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

libpoppler-qt4-4

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

libpoppler60

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

poppler-tools

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

libpoppler-cpp0

SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

0.43.0-16.49.1

libpoppler-devel

SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

0.43.0-16.49.1

References

ADVISORY

https://bugzilla.suse.com/1230939

ADVISORY

https://bugzilla.suse.com/1231294

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2024-October/019581.html

ADVISORY

https://www.suse.com/security/cve/CVE-2024-47176/

ADVISORY

https://www.suse.com/security/cve/CVE-2024-47850/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2024/suse-su-20243570-1/