The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cups | Aug 30, 2017 | Jul 29, 2014 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Jul 29, 2014 |
| Oracle_linux | — | Upgrade cups-lpdUpgrade cups-develUpgrade cups-phpUpgrade cupsUpgrade cups-libs | Oct 16, 2024 | Jul 29, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 22, 2014 |
| Suse | — | Upgrade libcupscgi1Upgrade cups-configUpgrade cupsUpgrade libcups2Upgrade libcupsppdc1Upgrade cups154Upgrade cups-libs-32bitUpgrade cups-clientUpgrade cups-ddkUpgrade cups-libsUpgrade libcupsmime1Upgrade cups154-clientUpgrade cups154-libsUpgrade cups-libs-x86Upgrade libcups2-32bitUpgrade cups-develUpgrade libcupsimage2Upgrade cups154-filters | Dec 18, 2015 | Jul 29, 2014 |
| Ubuntu | — | Upgrade cups | Nov 8, 2024 | Jul 29, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub