The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade hplip-commonUpgrade hpijsUpgrade hplip3Upgrade hplip3-guiUpgrade hplip-libsUpgrade hplip3-libsUpgrade hplip3-commonUpgrade libsane-hpaio3Upgrade hpijs3Upgrade hplip-guiUpgrade hplipUpgrade libsane-hpaio | Dec 1, 2016 | May 25, 2012 |
| Debian | — | Upgrade hplip | Jul 30, 2024 | May 25, 2012 |
| Gentoo Linux | — | Upgrade net-print/hplip. | Oct 30, 2017 | May 25, 2012 |
| Oracle_linux | — | Upgrade hpijsUpgrade libsane-hpaioUpgrade hplipUpgrade hplip-libsUpgrade hplip-commonUpgrade hplip-gui | Oct 16, 2024 | May 25, 2012 |
| Suse | — | Upgrade hplip-hpijsUpgrade hplipUpgrade hplip-develUpgrade hplip-sane | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade hplip | Nov 8, 2024 | May 25, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub