PT-2015-7805 · Openprinting+5 · Foomatic+6

Adam Chester · Publicado 2015-12-15 · Atualizado 2024-06-15 · CVE-2015-8560

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cups-filters versions 1.0.42 through 1.4.0 Foomatic versions 4.0.x

Description The issue allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job. This is due to an incomplete blacklist vulnerability in util.c in foomatic-rip.

Recommendations For cups-filters versions 1.0.42 through 1.4.0, update to version 1.4.0 or later. For Foomatic versions 4.0.x, consider disabling the foomatic-rip function until a patch is available. Restrict access to the util.c module to minimize the risk of exploitation.

Correção

Identificadores relacionados

ALT-PU-2016-1627

CESA-2016_0491

CVE-2015-8560

DLA-371-1

DSA-3419-1

DSA-3429-1

MGASA-2015-0476

OPENSUSE-SU-2024:10313-1

RHSA-2016:0491

RHSA-2016_0491

SUSE-SU-2016:0112-1

USN-2838-1

USN-2838-2

Produtos afetados

Alt Linux

Centos

Foomatic

Red Hat

Suse

Ubuntu

Cups-Filters

Referências · 64

• https://suse.com/security/cve/CVE-2013-6473 · Nota
• http://rhn.redhat.com/errata/RHSA-2016-0491.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2016-March/083930.html · Nota
• https://osv.dev/vulnerability/USN-2838-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-5325 · Nota
• https://suse.com/security/cve/CVE-2014-4338 · Nota
• https://suse.com/security/cve/CVE-2015-8560 · Nota
• https://osv.dev/vulnerability/CVE-2015-8560 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-8560 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10313-1 · Aviso do Fabricante
• https://bugzilla.suse.com/957531 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8327 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/foomatic-filters · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-2265 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8560 · Nota de Segurança