Description
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.5.3-2.7 | — |
| Debian 13 | cups | 1.5.3-2.7 | — |
| Debian 12 | cups | 1.5.3-2.7 | — |
| Debian 6.0 | cups | 1.4.4-7+squeeze2 | DSA-2600-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | cups +4 | 1:1.4.2-50.el6_4.4 | RHSA-2013:0580 |
| RHEL 5 | cups +3 | 1:1.3.7-30.el5_9.3 | RHSA-2013:0580 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | cups | 1.7.5-9.1 | SUSE-SU-2015:1041-1 |
| SLES 12 | cups154 | 1.5.4-9.1 | SUSE-SU-2015:1044-2, SUSE-SU-2015:1044-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | cups | 1.7.5-9.1 | SUSE-SU-2015:1041-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.1.3-2.3 | openSUSE-SU-2024:10075-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
p1ckzi/CVE-2012-5519 ★ 9 · Jan 7, 2022
cups-root-file-read.sh | CVE-2012-5519
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2013:0580 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2600-1 cups - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2015:1044-2 Security update for cups154 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1044-1 Security update for cups154 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10075-1 cups-2.1.3-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1041-1 Security update for cups SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20121111 Re: Privilege escalation (lpadmin -> root) in cups mailing-list
- USN-1654-1 vendor-advisory
- http://support.apple.com/kb/HT5784
- APPLE-SA-2013-06-04-1 vendor-advisory
- SUSE-SU-2015:1044 vendor-advisory
- cups-systemgroup-priv-esc(80012) vdb-entry
- [oss-security] 20121111 Re: Privilege escalation (lpadmin -> root) in cups mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692791
- RHSA-2013:0580 vendor-advisory
- SUSE-SU-2015:1041 vendor-advisory
- [oss-security] 20121110 Privilege escalation (lpadmin -> root) in cups mailing-list
- 56494 vdb-entry
- openSUSE-SU-2015:1056 vendor-advisory