The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade hplip3-guiUpgrade hplip3Upgrade hpijsUpgrade hplip-commonUpgrade hplipUpgrade hplip-libsUpgrade hplip3-libsUpgrade hplip-guiUpgrade hplip3-commonUpgrade libsane-hpaioUpgrade libsane-hpaio3Upgrade hpijs3 | Dec 1, 2016 | May 25, 2012 |
| Debian | — | Upgrade hplip | Jul 30, 2024 | May 25, 2012 |
| Gentoo Linux | — | Upgrade net-print/hplip. | Oct 30, 2017 | May 25, 2012 |
| Oracle_linux | — | Upgrade hplip-guiUpgrade hplip-libsUpgrade hplip-commonUpgrade hplipUpgrade libsane-hpaioUpgrade hpijs | Oct 16, 2024 | May 25, 2012 |
| Suse | — | Upgrade hplipUpgrade hplip-develUpgrade hplip-hpijsUpgrade hplip-sane | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade hplip | Nov 8, 2024 | May 25, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub