Description
The alert-mailing implementation in HP Linux Imaging and Printing (HPLIP) 1.6.7 allows local users to gain privileges and send e-mail messages from the root account via vectors related to the setalerts message, and lack of validation of the device URI associated with an event message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | hplip | 2.8.6-1 | — |
| Debian 12 | hplip | 2.8.6-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | hpijs | 1:1.6.7-4.1.el5_2.4 | RHSA-2008:0818 |
| RHEL 5 | hplip +1 | 1.6.7-4.1.el5_2.4 | RHSA-2008:0818 |
Advisories 1
- RHSA-2008:0818 Red Hat Security Advisory: hplip security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- hplip-alertmailing-privilege-escalation(44441) vdb-entry
- 30683 vdb-entry
- oval:org.mitre.oval:def:10136 vdb-entry signature
- 31470 third-party-advisory
- MDVSA-2008:169 vendor-advisory
- SUSE-SR:2008:021 vendor-advisory
- USN-674-1 vendor-advisory
- USN-674-2 vendor-advisory
- 1020684 vdb-entry
- 32792 third-party-advisory
- 31499 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=455235
- 32316 third-party-advisory
- RHSA-2008:0818 vendor-advisory