The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cups | Aug 30, 2017 | Jul 29, 2014 |
| Apple Osx Cups | — | Upgrade macOS to the latest version | Apr 5, 2017 | Jul 23, 2014 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Jul 23, 2014 |
| Oracle_linux | — | Upgrade cups-phpUpgrade cups-lpdUpgrade cups-develUpgrade cups-libsUpgrade cups | Oct 16, 2024 | Jul 23, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 14, 2014 |
| Suse | — | Upgrade cups154Upgrade libcupsppdc1Upgrade cups-libs-32bitUpgrade cups154-filtersUpgrade libcups2-32bitUpgrade cups-libsUpgrade libcupsimage2Upgrade cups154-clientUpgrade libcups2Upgrade libcupscgi1Upgrade cups-libs-x86Upgrade cups-configUpgrade cups-ddkUpgrade cups154-libsUpgrade libcupsmime1Upgrade cupsUpgrade cups-develUpgrade cups-client | Dec 18, 2015 | Jul 23, 2014 |
| Ubuntu | — | Upgrade cups | Nov 8, 2024 | Jul 23, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub