PT-2014-4923 · Apple+3 · Cups+3

Alex Korobkin · Publicado 2014-04-18 · Atualizado 2024-06-15 · CVE-2014-2856

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CUPS versions prior to 1.7.2

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is path absolute function. This is due to a flaw in the scheduler/client.c component of the Common Unix Printing System (CUPS).

Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the scheduler/client.c component to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2014-1513

CESA-2014_1388

CVE-2014-2856

MGASA-2014-0193

OPENSUSE-SU-2024:10075-1

RHSA-2014:1388

RHSA-2014_1388

USN-2172-1

Produtos afetados

Alt Linux

Cups

Centos

Red Hat

Referências · 64

• https://errata.altlinux.org/ALT-PU-2014-1513 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3537 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2014-October/007360.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2014-1388.html · Nota
• https://access.redhat.com/security/cve/CVE-2014-5029 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2014-October/020740.html · Nota
• https://suse.com/security/cve/CVE-2014-5031 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2856 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2012-5519 · Nota
• http://cups.org/str.php?L4319 · Nota
• http://advisories.mageia.org/MGASA-2014-0193.html · Nota
• https://suse.com/security/cve/CVE-2012-6094 · Nota
• https://cve.org/CVERecord?id=CVE-2014-2856 · Nota de Segurança
• https://suse.com/security/cve/CVE-2010-0540 · Nota