Description
lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers an error message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.22-2 | — |
| Debian 13 | cups | 1.1.22-2 | — |
| Debian 12 | cups | 1.1.22-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.6 | RHSA-2005:053 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.22 | RHSA-2005:013 |
Advisories 2
- RHSA-2005:053 Red Hat Security Advisory: CUPS security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:013 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2005:013 vendor-advisory
- cups-lppasswd-passwd-modify(18609) vdb-entry
- MDKSA-2005:008 vendor-advisory
- RHSA-2005:053 vendor-advisory
- USN-50-1 vendor-advisory
- GLSA-200412-25 vendor-advisory
- oval:org.mitre.oval:def:11507 vdb-entry signature
- http://tigger.uic.edu/~jlongs2/holes/cups2.txt