Red Hat Security AdvisoryRHSA-2014:1388
cups security and bug fix update
Released 2014-10-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) cups-1:1.4.2-67.el6, cups-libs-1:1.4.2-67.el6, cups-lpd-1:1.4.2-67.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) cups-devel-1:1.4.2-67.el6, cups-php-1:1.4.2-67.el6
- Red Hat Enterprise Linux HPC Node (v. 6) cups-1:1.4.2-67.el6, cups-libs-1:1.4.2-67.el6, cups-lpd-1:1.4.2-67.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) cups-devel-1:1.4.2-67.el6, cups-php-1:1.4.2-67.el6
- Red Hat Enterprise Linux Server (v. 6) cups-1:1.4.2-67.el6, cups-devel-1:1.4.2-67.el6, cups-devel-1:1.4.2-67.el6.ppc +3
- Red Hat Enterprise Linux Server Optional (v. 6) cups-php-1:1.4.2-67.el6
- Red Hat Enterprise Linux Workstation (v. 6) cups-1:1.4.2-67.el6, cups-devel-1:1.4.2-67.el6, cups-libs-1:1.4.2-67.el6 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) cups-php-1:1.4.2-67.el6
Fixes 5 records
Priority LOW 28
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02911 · Published 2014-07-29 · Partial fix CWE-264
Priority LOW 23
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_ab…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01626 · Published 2014-04-18 · Partial fix CWE-79
Priority LOW 10
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.
CVSS 2.0LOW 1.9· Local · No auth · Interaction — · EPSS 0.00362 · Published 2014-07-29 · Partial fix CWE-59
Priority LOW 9
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null.
CVSS 2.0LOW 1.5· Local · Low privileges · Interaction — · EPSS 0.00323 · Published 2014-07-29 · Partial fix CWE-59
Priority LOW 8
The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.
CVSS 2.0LOW 1.2· Local · No auth · Interaction — · EPSS 0.00379 · Published 2014-07-23 · Partial fix CWE-59
THREATIST.IORead the docs