var-201407-0413
Vulnerability from variot
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537. CUPS is prone to a local privilege-escalation vulnerability. An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible. Note: This issue is the result of an incomplete fix for the issue described in 68788 (CUPS Web Interface CVE-2014-3537 Local Privilege Escalation Vulnerability). An attacker with local access could potentially exploit this issue to gain elevated privileges. CUPS 1.7.4 and earlier versions are vulnerable. The system is based on the Internet Printing Protocol (IPP) and provides most PostScript and raster printer services. ============================================================================ Ubuntu Security Notice USN-2341-1 September 08, 2014
cups vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
CUPS could be made to expose sensitive information, leading to privilege escalation.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04 LTS: cups 1.7.2-0ubuntu1.2
Ubuntu 12.04 LTS: cups 1.5.3-0ubuntu8.5
Ubuntu 10.04 LTS: cups 1.4.3-1ubuntu1.13
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: cups security and bug fix update Advisory ID: RHSA-2014:1388-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1388.html Issue date: 2014-10-14 CVE Names: CVE-2014-2856 CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031 =====================================================================
- Summary:
Updated cups packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
- Description:
CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. An attacker could use this flaw to perform a cross-site scripting attack against users of the CUPS web interface. (CVE-2014-2856)
It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. (CVE-2014-3537, CVE-2014-5029, CVE-2014-5030, CVE-2014-5031)
The CVE-2014-3537 issue was discovered by Francisco Alonso of Red Hat Product Security.
These updated cups packages also include several bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.6 Technical Notes, linked to in the References section, for information on the most significant of these changes.
All cups users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the cupsd daemon will be restarted automatically.
- Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
978387 - Bad IPP responses with version 2.0 (collection handling bug) 1012482 - /etc/cron.daily/cups breaks rule GEN003080 in Red Hat security guide 1087122 - CVE-2014-2856 cups: cross-site scripting flaw fixed in the 1.7.2 release 1115576 - CVE-2014-3537 cups: insufficient checking leads to privilege escalation 1122600 - CVE-2014-5029 cups: Incomplete fix for CVE-2014-3537 1128764 - CVE-2014-5030 cups: allows local users to read arbitrary files via a symlink attack 1128767 - CVE-2014-5031 cups: world-readable permissions
- Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source: cups-1.4.2-67.el6.src.rpm
i386: cups-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-lpd-1.4.2-67.el6.i686.rpm
x86_64: cups-1.4.2-67.el6.x86_64.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.x86_64.rpm cups-lpd-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
i386: cups-debuginfo-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-php-1.4.2-67.el6.i686.rpm
x86_64: cups-debuginfo-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.x86_64.rpm cups-php-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source: cups-1.4.2-67.el6.src.rpm
x86_64: cups-1.4.2-67.el6.x86_64.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.x86_64.rpm cups-lpd-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
x86_64: cups-debuginfo-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.x86_64.rpm cups-php-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: cups-1.4.2-67.el6.src.rpm
i386: cups-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-lpd-1.4.2-67.el6.i686.rpm
ppc64: cups-1.4.2-67.el6.ppc64.rpm cups-debuginfo-1.4.2-67.el6.ppc.rpm cups-debuginfo-1.4.2-67.el6.ppc64.rpm cups-devel-1.4.2-67.el6.ppc.rpm cups-devel-1.4.2-67.el6.ppc64.rpm cups-libs-1.4.2-67.el6.ppc.rpm cups-libs-1.4.2-67.el6.ppc64.rpm cups-lpd-1.4.2-67.el6.ppc64.rpm
s390x: cups-1.4.2-67.el6.s390x.rpm cups-debuginfo-1.4.2-67.el6.s390.rpm cups-debuginfo-1.4.2-67.el6.s390x.rpm cups-devel-1.4.2-67.el6.s390.rpm cups-devel-1.4.2-67.el6.s390x.rpm cups-libs-1.4.2-67.el6.s390.rpm cups-libs-1.4.2-67.el6.s390x.rpm cups-lpd-1.4.2-67.el6.s390x.rpm
x86_64: cups-1.4.2-67.el6.x86_64.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.x86_64.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.x86_64.rpm cups-lpd-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
i386: cups-debuginfo-1.4.2-67.el6.i686.rpm cups-php-1.4.2-67.el6.i686.rpm
ppc64: cups-debuginfo-1.4.2-67.el6.ppc64.rpm cups-php-1.4.2-67.el6.ppc64.rpm
s390x: cups-debuginfo-1.4.2-67.el6.s390x.rpm cups-php-1.4.2-67.el6.s390x.rpm
x86_64: cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-php-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: cups-1.4.2-67.el6.src.rpm
i386: cups-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-lpd-1.4.2-67.el6.i686.rpm
x86_64: cups-1.4.2-67.el6.x86_64.rpm cups-debuginfo-1.4.2-67.el6.i686.rpm cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-devel-1.4.2-67.el6.i686.rpm cups-devel-1.4.2-67.el6.x86_64.rpm cups-libs-1.4.2-67.el6.i686.rpm cups-libs-1.4.2-67.el6.x86_64.rpm cups-lpd-1.4.2-67.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
i386: cups-debuginfo-1.4.2-67.el6.i686.rpm cups-php-1.4.2-67.el6.i686.rpm
x86_64: cups-debuginfo-1.4.2-67.el6.x86_64.rpm cups-php-1.4.2-67.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2014-2856.html https://www.redhat.com/security/data/cve/CVE-2014-3537.html https://www.redhat.com/security/data/cve/CVE-2014-5029.html https://www.redhat.com/security/data/cve/CVE-2014-5030.html https://www.redhat.com/security/data/cve/CVE-2014-5031.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/cups.html#RHSA-2014-1388
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iD8DBQFUPKsIXlSAg2UNWIIRApSvAJ9WxP5yQ+v5GDRGnSINYq0Pro0AoQCfXZqW WjIIQcBG+Sou8Is2vIFlLok= =5S/K -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce .
A malformed file with an invalid page header and compressed raster data can trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679).
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679 http://advisories.mageia.org/MGASA-2014-0193.html http://advisories.mageia.org/MGASA-2014-0313.html http://advisories.mageia.org/MGASA-2015-0067.html
Updated Packages:
Mandriva Business Server 2/X86_64: 0d1f31885b6c118b63449f2fdd821666 mbs2/x86_64/cups-1.7.0-8.1.mbs2.x86_64.rpm b5337600a386f902763653796a2cefdf mbs2/x86_64/cups-common-1.7.0-8.1.mbs2.x86_64.rpm 7b1513d85b5f22cd90bed23a35e44f51 mbs2/x86_64/cups-filesystem-1.7.0-8.1.mbs2.noarch.rpm c25fa9b9bba101274984fa2b7a62f7a3 mbs2/x86_64/lib64cups2-1.7.0-8.1.mbs2.x86_64.rpm df24a6b84fdafffaadf961ab4aa3640b mbs2/x86_64/lib64cups2-devel-1.7.0-8.1.mbs2.x86_64.rpm 5c172624c992de8ebb2bf8a2b232ee3a mbs2/SRPMS/cups-1.7.0-8.1.mbs2.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
iD8DBQFVF6q1mqjQ0CJFipgRAuxXAKDq8A/WlNzp54yRN7xnKy8ZBaRZQwCfSAh0 n7hHPzmYVzh2wFP6PffIl0E= =ykhv -----END PGP SIGNATURE----- .
For the stable distribution (wheezy), these problems have been fixed in version 1.5.3-5+deb7u4.
For the unstable distribution (sid), these problems have been fixed in version 1.7.4-2
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0413",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cups",
"scope": "eq",
"trust": 2.1,
"vendor": "apple",
"version": "1.7.4"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.6,
"vendor": "canonical",
"version": "10.04"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "12.04"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "14.04"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "14.04"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "business server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "1x8664"
},
{
"model": "business server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.7.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.11"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.7"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.5"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.23"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.23"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.22"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.22"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.21"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups rc5",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.19"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.18"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.17"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.7.2"
},
{
"model": "cups b1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.7.1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.7.1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.7.0"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.7"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.6.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.6.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.6.2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.6.1"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.6"
},
{
"model": "cups b1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.6"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5.2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5.1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5.0"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5"
},
{
"model": "cups b2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5"
},
{
"model": "cups b1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.5"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.8"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.7"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.6"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.5"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4.0"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4"
},
{
"model": "cups b3",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4"
},
{
"model": "cups b2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4"
},
{
"model": "cups b1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.9"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.8"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.7-18"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.6"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.10"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.0"
},
{
"model": "cups rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "cups b1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.9"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.8"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.7"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.6"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.5"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.12"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.11"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.10"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.0"
},
{
"model": "cups rc3",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "cups rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "cups b2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "cups b1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.9-1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.9"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.8"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.7"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.6-3"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.6-2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.6-1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.6"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.5-2"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.5-1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.5"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "cups rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.22"
},
{
"model": "cups rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.21"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.21"
},
{
"model": "cups rc6",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups rc5",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups rc4",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups rc3",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.20"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "cups rc4",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.19"
},
{
"model": "cups rc3",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.19"
},
{
"model": "cups rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.19"
},
{
"model": "cups rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.19"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.19"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.16"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.15"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.14"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.13"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.12"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.11"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.10-1"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.10"
},
{
"model": "cups",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "cups 2.0-current",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "68842"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:cups:1.7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5029"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Salvatore Bonaccorso",
"sources": [
{
"db": "BID",
"id": "68842"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5029",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 1.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 2.7,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Local",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 1.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2014-5029",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 1.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 2.7,
"id": "VHN-72970",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:M/AU:S/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-5029",
"trust": 1.8,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-652",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-72970",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72970"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537. CUPS is prone to a local privilege-escalation vulnerability. \nAn attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible. \nNote: This issue is the result of an incomplete fix for the issue described in 68788 (CUPS Web Interface CVE-2014-3537 Local Privilege Escalation Vulnerability). \nAn attacker with local access could potentially exploit this issue to gain elevated privileges. \nCUPS 1.7.4 and earlier versions are vulnerable. The system is based on the Internet Printing Protocol (IPP) and provides most PostScript and raster printer services. ============================================================================\nUbuntu Security Notice USN-2341-1\nSeptember 08, 2014\n\ncups vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 LTS\n- Ubuntu 12.04 LTS\n- Ubuntu 10.04 LTS\n\nSummary:\n\nCUPS could be made to expose sensitive information, leading to privilege\nescalation. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 LTS:\n cups 1.7.2-0ubuntu1.2\n\nUbuntu 12.04 LTS:\n cups 1.5.3-0ubuntu8.5\n\nUbuntu 10.04 LTS:\n cups 1.4.3-1ubuntu1.13\n\nIn general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: cups security and bug fix update\nAdvisory ID: RHSA-2014:1388-02\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2014-1388.html\nIssue date: 2014-10-14\nCVE Names: CVE-2014-2856 CVE-2014-3537 CVE-2014-5029 \n CVE-2014-5030 CVE-2014-5031 \n=====================================================================\n\n1. Summary:\n\nUpdated cups packages that fix multiple security issues and several bugs\nare now available for Red Hat Enterprise Linux 6. \n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64\nRed Hat Enterprise Linux HPC Node (v. 6) - x86_64\nRed Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\n\n3. Description:\n\nCUPS provides a portable printing layer for Linux, UNIX, and similar\noperating systems. \nAn attacker could use this flaw to perform a cross-site scripting attack\nagainst users of the CUPS web interface. (CVE-2014-2856)\n\nIt was discovered that CUPS allowed certain users to create symbolic links\nin certain directories under /var/cache/cups/. (CVE-2014-3537, CVE-2014-5029, CVE-2014-5030, CVE-2014-5031)\n\nThe CVE-2014-3537 issue was discovered by Francisco Alonso of Red Hat\nProduct Security. \n\nThese updated cups packages also include several bug fixes. Space precludes\ndocumenting all of these changes in this advisory. Users are directed to\nthe Red Hat Enterprise Linux 6.6 Technical Notes, linked to in the\nReferences section, for information on the most significant of these\nchanges. \n\nAll cups users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing this\nupdate, the cupsd daemon will be restarted automatically. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n978387 - Bad IPP responses with version 2.0 (collection handling bug)\n1012482 - /etc/cron.daily/cups breaks rule GEN003080 in Red Hat security guide\n1087122 - CVE-2014-2856 cups: cross-site scripting flaw fixed in the 1.7.2 release\n1115576 - CVE-2014-3537 cups: insufficient checking leads to privilege escalation\n1122600 - CVE-2014-5029 cups: Incomplete fix for CVE-2014-3537\n1128764 - CVE-2014-5030 cups: allows local users to read arbitrary files via a symlink attack\n1128767 - CVE-2014-5031 cups: world-readable permissions\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 6):\n\nSource:\ncups-1.4.2-67.el6.src.rpm\n\ni386:\ncups-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-lpd-1.4.2-67.el6.i686.rpm\n\nx86_64:\ncups-1.4.2-67.el6.x86_64.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.x86_64.rpm\ncups-lpd-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Optional (v. 6):\n\ni386:\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-php-1.4.2-67.el6.i686.rpm\n\nx86_64:\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.x86_64.rpm\ncups-php-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node (v. 6):\n\nSource:\ncups-1.4.2-67.el6.src.rpm\n\nx86_64:\ncups-1.4.2-67.el6.x86_64.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.x86_64.rpm\ncups-lpd-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node Optional (v. 6):\n\nx86_64:\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.x86_64.rpm\ncups-php-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\ncups-1.4.2-67.el6.src.rpm\n\ni386:\ncups-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-lpd-1.4.2-67.el6.i686.rpm\n\nppc64:\ncups-1.4.2-67.el6.ppc64.rpm\ncups-debuginfo-1.4.2-67.el6.ppc.rpm\ncups-debuginfo-1.4.2-67.el6.ppc64.rpm\ncups-devel-1.4.2-67.el6.ppc.rpm\ncups-devel-1.4.2-67.el6.ppc64.rpm\ncups-libs-1.4.2-67.el6.ppc.rpm\ncups-libs-1.4.2-67.el6.ppc64.rpm\ncups-lpd-1.4.2-67.el6.ppc64.rpm\n\ns390x:\ncups-1.4.2-67.el6.s390x.rpm\ncups-debuginfo-1.4.2-67.el6.s390.rpm\ncups-debuginfo-1.4.2-67.el6.s390x.rpm\ncups-devel-1.4.2-67.el6.s390.rpm\ncups-devel-1.4.2-67.el6.s390x.rpm\ncups-libs-1.4.2-67.el6.s390.rpm\ncups-libs-1.4.2-67.el6.s390x.rpm\ncups-lpd-1.4.2-67.el6.s390x.rpm\n\nx86_64:\ncups-1.4.2-67.el6.x86_64.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.x86_64.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.x86_64.rpm\ncups-lpd-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\ni386:\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-php-1.4.2-67.el6.i686.rpm\n\nppc64:\ncups-debuginfo-1.4.2-67.el6.ppc64.rpm\ncups-php-1.4.2-67.el6.ppc64.rpm\n\ns390x:\ncups-debuginfo-1.4.2-67.el6.s390x.rpm\ncups-php-1.4.2-67.el6.s390x.rpm\n\nx86_64:\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-php-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\ncups-1.4.2-67.el6.src.rpm\n\ni386:\ncups-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-lpd-1.4.2-67.el6.i686.rpm\n\nx86_64:\ncups-1.4.2-67.el6.x86_64.rpm\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-devel-1.4.2-67.el6.i686.rpm\ncups-devel-1.4.2-67.el6.x86_64.rpm\ncups-libs-1.4.2-67.el6.i686.rpm\ncups-libs-1.4.2-67.el6.x86_64.rpm\ncups-lpd-1.4.2-67.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\ni386:\ncups-debuginfo-1.4.2-67.el6.i686.rpm\ncups-php-1.4.2-67.el6.i686.rpm\n\nx86_64:\ncups-debuginfo-1.4.2-67.el6.x86_64.rpm\ncups-php-1.4.2-67.el6.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2014-2856.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-3537.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-5029.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-5030.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-5031.html\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/cups.html#RHSA-2014-1388\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2014 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFUPKsIXlSAg2UNWIIRApSvAJ9WxP5yQ+v5GDRGnSINYq0Pro0AoQCfXZqW\nWjIIQcBG+Sou8Is2vIFlLok=\n=5S/K\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \n \n A malformed file with an invalid page header and compressed raster data\n can trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679). \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9679\n http://advisories.mageia.org/MGASA-2014-0193.html\n http://advisories.mageia.org/MGASA-2014-0313.html\n http://advisories.mageia.org/MGASA-2015-0067.html\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Business Server 2/X86_64:\n 0d1f31885b6c118b63449f2fdd821666 mbs2/x86_64/cups-1.7.0-8.1.mbs2.x86_64.rpm\n b5337600a386f902763653796a2cefdf mbs2/x86_64/cups-common-1.7.0-8.1.mbs2.x86_64.rpm\n 7b1513d85b5f22cd90bed23a35e44f51 mbs2/x86_64/cups-filesystem-1.7.0-8.1.mbs2.noarch.rpm\n c25fa9b9bba101274984fa2b7a62f7a3 mbs2/x86_64/lib64cups2-1.7.0-8.1.mbs2.x86_64.rpm\n df24a6b84fdafffaadf961ab4aa3640b mbs2/x86_64/lib64cups2-devel-1.7.0-8.1.mbs2.x86_64.rpm \n 5c172624c992de8ebb2bf8a2b232ee3a mbs2/SRPMS/cups-1.7.0-8.1.mbs2.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/en/support/security/advisories/\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.12 (GNU/Linux)\n\niD8DBQFVF6q1mqjQ0CJFipgRAuxXAKDq8A/WlNzp54yRN7xnKy8ZBaRZQwCfSAh0\nn7hHPzmYVzh2wFP6PffIl0E=\n=ykhv\n-----END PGP SIGNATURE-----\n. \n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 1.5.3-5+deb7u4. \n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.7.4-2",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "BID",
"id": "68842"
},
{
"db": "VULHUB",
"id": "VHN-72970"
},
{
"db": "PACKETSTORM",
"id": "128171"
},
{
"db": "PACKETSTORM",
"id": "127797"
},
{
"db": "PACKETSTORM",
"id": "128661"
},
{
"db": "PACKETSTORM",
"id": "131116"
},
{
"db": "PACKETSTORM",
"id": "127631"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-5029",
"trust": 3.3
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2014/07/22/2",
"trust": 2.5
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2014/07/22/13",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "60509",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "60787",
"trust": 1.1
},
{
"db": "BID",
"id": "68842",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "128171",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-72970",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127797",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128661",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "131116",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127631",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72970"
},
{
"db": "BID",
"id": "68842"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "PACKETSTORM",
"id": "128171"
},
{
"db": "PACKETSTORM",
"id": "127797"
},
{
"db": "PACKETSTORM",
"id": "128661"
},
{
"db": "PACKETSTORM",
"id": "131116"
},
{
"db": "PACKETSTORM",
"id": "127631"
},
{
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"id": "VAR-201407-0413",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-72970"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:26:49.267000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Release Notes",
"trust": 0.8,
"url": "http://www.cups.org/documentation.php/relnotes.html"
},
{
"title": "STR #4455",
"trust": 0.8,
"url": "https://cups.org/str.php?l4455"
},
{
"title": "RHSA-2014:1388",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2014-1388.html"
},
{
"title": "str4455-1.7",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=50970"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-59",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72970"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "NVD",
"id": "CVE-2014-5029"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.openwall.com/lists/oss-security/2014/07/22/2"
},
{
"trust": 2.5,
"url": "http://www.openwall.com/lists/oss-security/2014/07/22/13"
},
{
"trust": 2.3,
"url": "http://secunia.com/advisories/60509"
},
{
"trust": 2.1,
"url": "http://advisories.mageia.org/mgasa-2014-0313.html"
},
{
"trust": 2.0,
"url": "https://cups.org/str.php?l4455"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2014/dsa-2990"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2014-1388.html"
},
{
"trust": 1.2,
"url": "http://www.ubuntu.com/usn/usn-2341-1"
},
{
"trust": 1.1,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2015:108"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/60787"
},
{
"trust": 1.0,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5029"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5029"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/68842"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-5029"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-5030"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-5031"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3537"
},
{
"trust": 0.3,
"url": "http://www.cups.org/"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5031"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3537"
},
{
"trust": 0.2,
"url": "http://www.mandriva.com/en/support/security/"
},
{
"trust": 0.2,
"url": "http://www.mandriva.com/en/support/security/advisories/"
},
{
"trust": 0.2,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5030"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-2856"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cups/1.4.3-1ubuntu1.13"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cups/1.7.2-0ubuntu1.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cups/1.5.3-0ubuntu8.5"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/6.6_technical_notes/cups.html#rhsa-2014-1388"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-2856.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-5029.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-5031.html"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-5030.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2014-3537.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9679"
},
{
"trust": 0.1,
"url": "http://advisories.mageia.org/mgasa-2014-0193.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2856"
},
{
"trust": 0.1,
"url": "http://advisories.mageia.org/mgasa-2015-0067.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-9679"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72970"
},
{
"db": "BID",
"id": "68842"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "PACKETSTORM",
"id": "128171"
},
{
"db": "PACKETSTORM",
"id": "127797"
},
{
"db": "PACKETSTORM",
"id": "128661"
},
{
"db": "PACKETSTORM",
"id": "131116"
},
{
"db": "PACKETSTORM",
"id": "127631"
},
{
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-72970"
},
{
"db": "BID",
"id": "68842"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"db": "PACKETSTORM",
"id": "128171"
},
{
"db": "PACKETSTORM",
"id": "127797"
},
{
"db": "PACKETSTORM",
"id": "128661"
},
{
"db": "PACKETSTORM",
"id": "131116"
},
{
"db": "PACKETSTORM",
"id": "127631"
},
{
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-72970"
},
{
"date": "2014-07-21T00:00:00",
"db": "BID",
"id": "68842"
},
{
"date": "2014-07-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"date": "2014-09-08T17:33:25",
"db": "PACKETSTORM",
"id": "128171"
},
{
"date": "2014-08-08T21:45:22",
"db": "PACKETSTORM",
"id": "127797"
},
{
"date": "2014-10-14T23:04:56",
"db": "PACKETSTORM",
"id": "128661"
},
{
"date": "2015-03-30T21:33:02",
"db": "PACKETSTORM",
"id": "131116"
},
{
"date": "2014-07-28T20:36:32",
"db": "PACKETSTORM",
"id": "127631"
},
{
"date": "2014-07-29T14:55:07.780000",
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"date": "2014-07-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-01-07T00:00:00",
"db": "VULHUB",
"id": "VHN-72970"
},
{
"date": "2015-04-13T21:32:00",
"db": "BID",
"id": "68842"
},
{
"date": "2015-06-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003632"
},
{
"date": "2017-01-07T03:00:25.037000",
"db": "NVD",
"id": "CVE-2014-5029"
},
{
"date": "2014-07-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "68842"
},
{
"db": "PACKETSTORM",
"id": "127797"
},
{
"db": "PACKETSTORM",
"id": "128661"
},
{
"db": "PACKETSTORM",
"id": "127631"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CUPS of Web Vulnerability to read arbitrary files in the interface",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003632"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "post link",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-652"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.