Multiple Vulnerabilities Disclosed in Linux-based CUPS Printing Service

On 26 September 2024 a researcher disclosed four CUPS vulnerabilities affecting GNU/Linux distributions (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177) that enable attacker-controlled IPP requests, unsanitised IPP attributes to flow through CUPS, PPD file injection, and arbitrary command execution via foomatic-rip; vendors were notified and patches are being prepared, the researcher released details early after an embargo leak, Arctic Wolf assesses low risk of internet-based initial access but notes plausible LAN lateral movement and recommends patching, blocking outbound port 631, disabling cups-browsed where possible, and inventorying hosts listening on port 631.