The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cups | Aug 30, 2017 | Jul 29, 2014 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Jul 29, 2014 |
| Oracle_linux | — | Upgrade cupsUpgrade cups-libsUpgrade cups-phpUpgrade cups-develUpgrade cups-lpd | Oct 16, 2024 | Jul 29, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 22, 2014 |
| Suse | — | Upgrade cupsUpgrade libcups2Upgrade cups-ddkUpgrade libcupsppdc1Upgrade cups-libsUpgrade cups-configUpgrade cups154Upgrade libcupscgi1Upgrade cups-libs-32bitUpgrade cups-clientUpgrade cups154-libsUpgrade libcupsmime1Upgrade cups-libs-x86Upgrade cups154-filtersUpgrade libcups2-32bitUpgrade cups154-clientUpgrade libcupsimage2Upgrade cups-devel | Dec 18, 2015 | Jul 29, 2014 |
| Ubuntu | — | Upgrade cups | Nov 8, 2024 | Jul 29, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub