The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Cups | — | Apply OS X security update 2010-002Upgrade macOS to the latest version | Dec 16, 2011 | Mar 5, 2010 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Mar 5, 2010 |
| Gentoo Linux | — | Upgrade net-print/cups. | Oct 30, 2017 | Mar 5, 2010 |
| Suse | — | Upgrade libcups2-32bitUpgrade cups154-clientUpgrade cups-libs-x86Upgrade libcupsppdc1Upgrade libcups2Upgrade cups-configUpgrade cups-libs-32bitUpgrade cups154-filtersUpgrade libcupsimage2Upgrade cupsUpgrade cups-develUpgrade cups154-libsUpgrade cups-libsUpgrade cups-clientUpgrade cups154Upgrade libcupscgi1Upgrade libcupsmime1Upgrade cups-ddk | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cups-clientUpgrade cupsUpgrade cupsys-clientUpgrade cupsys | Nov 8, 2024 | Mar 5, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub