Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cups-filters | Aug 30, 2017 | Dec 17, 2015 |
| Centos_linux | — | Upgrade foomatic | Jul 6, 2016 | Dec 17, 2015 |
| Debian | — | Upgrade foomatic-filtersUpgrade cups-filters | Dec 17, 2015 | Dec 17, 2015 |
| Freebsd | — | Upgrade foomatic-filtersUpgrade cups-filters | Dec 10, 2025 | Dec 17, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade foomaticUpgrade foomatic-filters | Dec 4, 2019 | Dec 17, 2015 |
| Huawei Euleros 2_0_sp3 | — | Upgrade foomatic-filtersUpgrade foomatic | Dec 18, 2019 | Dec 17, 2015 |
| Huawei Euleros 2_0_sp5 | — | Upgrade foomatic-filtersUpgrade foomatic | Sep 24, 2019 | Dec 17, 2015 |
| Oracle Solaris | — | Upgrade print/lp/filter/foomatic-rip to version 4.0.17.20160212-11.4.6.0.1.4.0 on Solaris 11.4 | Feb 20, 2019 | Dec 17, 2015 |
| Oracle_linux | — | Upgrade foomatic | Mar 28, 2016 | Dec 17, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 26, 2015 |
| Suse | — | Upgrade foomatic-filtersUpgrade cups-filters-cups-browsedUpgrade cups-filters-develUpgrade cups-filters-ghostscriptUpgrade cups-filtersUpgrade cups-filters-foomatic-rip | Jan 4, 2016 | Dec 17, 2015 |
| Ubuntu | — | Upgrade foomatic-filtersUpgrade cups-filters | Dec 17, 2015 | Dec 7, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub