CVE 9.9 is manjaro impacted by this?

[cscs]

x.com

ChatGPT removal instructions, you won’t be able to print after doing this

Of course you can stop and remove cups … but the provided ‘chatgpt’ instructions are silly.

For example … no need for sudo with systemctl. Also why use stop then disable instead of disable --now ?

Furthermore … thats not what the page actually proposes for remediation…

Remediation

• Disable and remove the cups-browsed service if you don’t need it (and probably you don’t).
• Update the CUPS package on your systems.
• In case your system can’t be updated and for some reason you rely on this service, block all traffic to UDP port 631 and possibly all DNS-SD traffic (good luck if you use zeroconf).

Entirely personal recommendation, take it or leave it: I’ve seen and attacked enough of this codebase to remove any CUPS service, binary and library from any of my systems and never again use a UNIX system to print. I’m also removing every zeroconf / avahi / bonjour listener. You might consider doing the same.

As to this …

@yoda9898

A 9.9 CVE has been announced for Linux

Ok so since no links were shared I hunted down the CVEs that do exist now.

https://www.cve.org/CVERecord?id=CVE-2024-47176

Affects cups-browsed v. 2.0.1 **

https://www.cve.org/CVERecord?id=CVE-2024-47076

Affects libcupsfilters v. <= 2.1b1 *

https://www.cve.org/CVERecord?id=CVE-2024-47175

Affects libppd v. <= 2.1b1

https://www.cve.org/CVERecord?id=CVE-2024-47177

Affects cups-filters v. <= 2.0.1

@yoda9898

CVE 9.9 is manjaro impacted by this?

Yes.
But it depends on the branch and the system.
In my case I dont have cups-browsed installed, etc.

---

* - This is fixed with 2.0.0-3.

** - This is mitigated with 2.0.1-2.