Unscored CVE-2014-8166 EUVD-2014-8007GHSA-fw6x-vp3m-9q59

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attack…

Published Jan 12, 2018 · Updated Aug 6, 2024 · Assigned by redhat

Description

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	cups	No fix yet	—
Debian 13	cups	No fix yet	—
Debian 12	cups	No fix yet	—

References

https://bugzilla.redhat.com/show_bug.cgi?id=1084577
73300 vdb-entry
[oss-security] 20150324 Re: CVE-2014-8166 cups: code execution via unescape ANSI escape sequences mailing-list
[oss-security] 20150323 CVE-2014-8166 cups: code execution via unescape ANSI escape sequences mailing-list