cups-filters: remote command execution
| Package(s): | cups-filters | CVE #(s): | CVE-2015-2265 | ||||||||||||||||||||||||
| Created: | March 16, 2015 | Updated: | April 7, 2015 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was reported that cups-browsed fails to properly sanitize data from the network when creating IPP printer scripts. As a result, an attacker can remotely create a script containing arbitrary commands, which will be executed as the "lp" user when the associated printer is used. This is the same vulnerability reported as CVE-2014-2707 but the existing fixes rely on a string sanitization function remove_bad_chars() which is not effective. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||