CVE-2017-15400 — cups: Insufficient restriction of IPP filters allows a remote attacker to execute commands with the privilege level of cups daemon

Back Back to CVE browser

HIGH

cups: Insufficient restriction of IPP filters allows a remote attacker to execute commands with the privilege level of cups daemon

Published Feb 7, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.86%

Description

Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.

Affected products

Vendor n/a Product Google Chrome OS prior to 62.0.3202.74 Default
n/a
- Version
  Google Chrome OS prior to 62.0.3202.74
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Google Chrome OS prior to 62.0.3202.74

n/a

Version	Status	Constraints
Google Chrome OS prior to 62.0.3202.74	affected	-

Red Hat Enterprise Linux 5

cups

Not affected
Red Hat Enterprise Linux 6

cups

Not affected
Red Hat Enterprise Linux 7

cups

Not affected
Red Hat Enterprise Linux 8

cups

Not affected
Red Hat Virtualization 4

cups

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	cups	Not affected	n/a
Red Hat Enterprise Linux 6	cups	Not affected	n/a
Red Hat Enterprise Linux 7	cups	Not affected	n/a
Red Hat Enterprise Linux 8	cups	Not affected	n/a
Red Hat Virtualization 4	cups	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.86% 0.00862

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00862

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.86% (0.00862)	57.09th	v5 (v2026.06.15)
Sep 20, 2026	0.86% (0.00862)	56.99th	v5 (v2026.06.15)
Jul 20, 2024	0.40% (0.00404)	73.92th	v3 (v2023.03.01)
Jun 24, 2024	0.40% (0.00404)	73.79th	v3 (v2023.03.01)
Feb 23, 2024	0.35% (0.00347)	70.97th	v3 (v2023.03.01)
Feb 8, 2024	0.29% (0.00289)	68.09th	v3 (v2023.03.01)
Jan 18, 2024	0.29% (0.00289)	65.75th	v3 (v2023.03.01)
Dec 18, 2023	0.24% (0.00245)	62.38th	v3 (v2023.03.01)
Mar 7, 2023	0.20% (0.00204)	56.51th	v3 (v2023.03.01)
Mar 6, 2023	1.21% (0.01213)	66.61th	v2 (v2022.01.01)
Feb 4, 2022	1.21% (0.01213)	40.54th	v2 (v2022.01.01)
Feb 3, 2022	0.54% (0.00541)	12.65th	v5 (v2026.06.15)
Apr 14, 2021	0.54% (0.00541)	0.00th	v1

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-93

References (8)

https://access.redhat.com/security/cve/CVE-2017-15400
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1607288
Issue Tracking
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
x_refsource_MISC
https://crbug.com/777215
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2017-15400
https://security.gentoo.org/glsa/201908-08
vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2017-15400
https://www.debian.org/security/2018/dsa-4243
vendor-advisoryx_refsource_DEBIAN

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-15400		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1607288		Issue Tracking
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html		x_refsource_MISC
https://crbug.com/777215		x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2017-15400
https://security.gentoo.org/glsa/201908-08		vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2017-15400
https://www.debian.org/security/2018/dsa-4243		vendor-advisoryx_refsource_DEBIAN