PT-2015-7805 · Openprinting+5 · Foomatic+6

Adam Chester · Published 2015-12-15 · Updated 2024-06-15 · CVE-2015-8560

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cups-filters versions 1.0.42 through 1.4.0 Foomatic versions 4.0.x

Description The issue allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job. This is due to an incomplete blacklist vulnerability in util.c in foomatic-rip.

Recommendations For cups-filters versions 1.0.42 through 1.4.0, update to version 1.4.0 or later. For Foomatic versions 4.0.x, consider disabling the foomatic-rip function until a patch is available. Restrict access to the util.c module to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2016-1627

CESA-2016_0491

CVE-2015-8560

DLA-371-1

DSA-3419-1

DSA-3429-1

MGASA-2015-0476

OPENSUSE-SU-2024:10313-1

RHSA-2016:0491

RHSA-2016_0491

SUSE-SU-2016:0112-1

USN-2838-1

USN-2838-2

Affected Products

Alt Linux

Centos

Foomatic

Red Hat

Suse

Ubuntu

Cups-Filters

References · 64

• http://rhn.redhat.com/errata/RHSA-2016-0491.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2838-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8560 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8560 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10313-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8327 · Security Note
• https://security-tracker.debian.org/tracker/source-package/foomatic-filters · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8560 · Security Note
• http://debian.org/security/2015/dsa-3429 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-0491.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0476.html · Security Note
• http://debian.org/security/2015/dsa-3419 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0112-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2838-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8560 · Security Note