SUSE-SU-2024:3570-1

UNKNOWN

Security update for cups-filters

Published Oct 9, 2024

Modified 1 years ago

Fix available

Details

This update for cups-filters fixes the following issues:

CVE-2024-47176: cups-browsed binds on UDP port 631 and trusts packets that try to trigger a Get-Printer-Attributes IPP request. (bsc#1230939)
CVE-2024-47850: cups-browsed can be abused to initiate remote DDoS against third-party targets (bsc#1231294)

The fix is disabling the CUPS protocol in cups-browsed.

Affected Packages(15 packages)

cups-filters

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

cups-filters-cups-browsed

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

cups-filters-foomatic-rip

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

cups-filters-ghostscript

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.0.58-19.26.1

libpoppler-glib8

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

libpoppler-qt4-4

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

libpoppler60

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

poppler

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

0.43.0-16.49.1

poppler-qt

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

0.43.0-16.49.1

poppler-tools

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

0.43.0-16.49.1

References

REPORT

https://bugzilla.suse.com/1230939

REPORT

https://bugzilla.suse.com/1231294

WEB

https://www.suse.com/security/cve/CVE-2024-47176

WEB

https://www.suse.com/security/cve/CVE-2024-47850

ADVISORY

https://www.suse.com/support/update/announcement/2024/suse-su-20243570-1/

Upstream

CVE-2024-47176 CVE-2024-47850

Ecosystems

SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5

Timeline

PublishedOct 9, 2024

ModifiedOct 9, 2024

SUSE-SU-2024:3570-1 | Mondoo Vulnerability Intelligence