CVE-2014-3537 The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.
LowCVSS 1.2
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cups(Debian:12) | < 1.7.4-1 | 1.7.4-1 |
| debian/cups(Debian:13) | < 1.7.4-1 | 1.7.4-1 |
| debian/cups(Debian:14) | < 1.7.4-1 | 1.7.4-1 |
| apple cups | <= 1.7.3 | No fix listed |
| apple cups | = 1.7-rc1 | No fix listed |
| apple cups | = 1.7.0 | No fix listed |
| apple cups | = 1.7.1 | No fix listed |
| apple cups | = 1.7.1-b1 | No fix listed |
| apple cups | = 1.7.2 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
References
- Debian Security Tracker CVE-2014-3537 vendor-advisory
- advisories.mageia.org
- APPLE-SA-2014-10-16-1 vendor-advisory
- FEDORA-2014-8351 vendor-advisory
- RHSA-2014:1388 vendor-advisory
- 59945 third-party-advisory
- 60273 third-party-advisory
- 60787 third-party-advisory
- www.cups.org vendor-advisory
- www.cups.org
- MDVSA-2015:108 vendor-advisory
- 68788 vdb-entry vendor-advisory
- 1030611 vdb-entry
- USN-2293-1 vendor-advisory
- bugzilla.redhat.com
- support.apple.com