CVE-2017-15400

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-07 · updated 2026-06-17
Weakness: CWE-93

Description

Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.

Affected products

Google ChromeOS: before 62.0.3202.74 — fixed in 62.0.3202.74

How to fix

Upgrade to a fixed version: Google ChromeOS 62.0.3202.74. Check the vendor advisory for mitigations.

References

https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
https://crbug.com/777215
https://security.gentoo.org/glsa/201908-08
https://www.debian.org/security/2018/dsa-4243
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
https://crbug.com/777215
https://security.gentoo.org/glsa/201908-08
https://www.debian.org/security/2018/dsa-4243

Get alerted when CVE-2017-15400 or the next vulnerability affects your stack