{"id":"CVE-2017-15400","aliases":["DEBIAN-CVE-2017-15400","DSA-4243-1","EUVD-2017-6853","GHSA-2m9r-8mxg-wqgx","UBUNTU-CVE-2017-15400"],"status":"published","title":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed...","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00862,"percentile":0.58812,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2018-02-07T23:00:00Z","modified":"2026-09-01T20:03:44Z","fixes":[{"ecosystem":"Debian:12","package":"cups","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.2.3-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-8+deb9u2"}]}],"versions":["2.2.1-8","2.2.1-8+deb9u1","2.2.1-8+deb9u1~bpo8+1"],"bundled":4}],"products":[{"vendor":"google","product":"chrome_os"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4243","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html","tags":["x_refsource_MISC","x_transferred","article","report"]},{"url":"https://crbug.com/777215","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201908-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15400"},{"url":"https://github.com/advisories/GHSA-2m9r-8mxg-wqgx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15400","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15400","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15400","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-15400","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"published","published":"2018-02-07T23:00:00Z","modified":"2024-08-05T19:57:26.09Z","updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6853","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"published","published":"2018-02-07T23:00:00Z","modified":"2024-08-05T19:57:26Z","updated_at":"2026-11-03T02:23:14.401805Z"}],"ghsa":[{"id":"GHSA-2m9r-8mxg-wqgx","title":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed...","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"published","published":"2022-05-14T03:14:40Z","modified":"2023-02-02T05:07:27Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:52:30.631112Z"}],"nvd":[{"id":"CVE-2017-15400","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"published","published":"2018-02-07T23:29:00.937Z","modified":"2026-06-17T01:07:45.947Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:04:13.257031Z"}],"osv":[{"id":"CVE-2017-15400","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"published","published":"2018-02-07T23:29:00.937Z","modified":"2026-03-14T09:24:35.367829Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15400","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"published","published":"2018-02-07T23:29:00.937Z","modified":"2026-09-01T20:03:44.631493865Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-15400","description":"Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.","status":"withdrawn","published":"2018-02-07T23:29:00Z","modified":"2025-07-16T07:36:14.873385Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DSA-4243-1","title":"cups - security update","status":"published","published":"2018-07-11T00:00:00Z","modified":"2026-03-09T02:08:39.270263Z","updated_at":"2026-11-02T15:46:16.862196Z"}]}}