Description
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.7.1-1 | — |
| Debian 13 | cups | 1.7.1-1 | — |
| Debian 12 | cups | 1.7.1-1 | — |
References
- http://advisories.mageia.org/MGASA-2014-0021.html
- http://www.cups.org/blog.php?L704
- USN-2082-1 vendor-advisory
- MDVSA-2014:015 vendor-advisory
- 56531 third-party-advisory
- http://www.cups.org/str.php?L4319