Cups
Monthly
Null pointer dereference in OpenPrinting CUPS allows unauthenticated remote attackers who can submit jobs to a shared printer queue to crash the cupsd print daemon, causing a temporary denial of service for all printing services. Exploitation requires a vulnerable version that still ships the deprecated embedded job-ticket comment feature and a single crafted PostScript or PDF file submitted via the Print-Job operation whose first lines contain a malformed %cupsJobTicket: entry. Impact is bounded to a brief daemon crash with automatic restart-there is no code execution or data exposure-and no public exploit code has been identified at time of analysis.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a crafted Print-Job IPP request terminate the cupsd scheduler, taking every queue it serves offline with it. Repeated IPP group tags cause the parser to create unnamed separator attributes (IPP_TAG_ZERO) that add_job() re-tags as IPP_TAG_JOB; when the job starts, get_options()/ipp_length() calls strlen() on the NULL attribute name and crashes the daemon (CWE-476). The vendor scores this 3.3 on a local vector, while our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, since an attacker who can reach the scheduler and submit to an enabled, accepting queue supporting the submitted document format can cause it; PR:L in the assessed vector indicates authenticated access is normally required, with anonymous submission possible only where listener and access-control configuration explicitly allow it. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a low-severity availability issue rather than an urgent priority for most environments.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a local, low-privileged user crash the cupsd scheduler by submitting a print job with the job-held-on-create attribute that references a temporary printer, which can then be auto-deleted while the held job still references it, triggering a NULL pointer dereference in cupsdCheckJobs(). The crash occurs when cupsdFindDest() returns NULL during the holding_new_jobs check, terminating cupsd and interrupting every queue it manages. Exploitation requires the temporary-printer feature (auto-created for shared or network-discovered destinations) to be in use and depends on timing between held-job submission and automatic printer cleanup, giving high attack complexity (AC:H) and availability-only impact (CVSS 5.1, C:N/I:N/A:H); no public exploit code has been identified at time of analysis.
Denial of service in OpenPrinting CUPS before 2.4.20 lets an actor holding @SYSTEM-level class-management privileges crash the cupsd scheduler by triggering a double-free in printer-class handling. The actor submits a CUPS-Add-Modify-Class request that replaces an existing class's member list and then fails subsequent validation, leaving pclass->printers as a dangling pointer, then issues a CUPS-Delete-Class request so cupsdDeletePrinter() frees the same allocation a second time. Impact is confined to availability (scheduler crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis - the @SYSTEM privilege prerequisite (PR:H) is the dominant limiting factor, keeping overall risk low even though the assessed vector is network-reachable (AV:N/AC:H) when the CUPS listener is exposed.
Resource exhaustion in OpenPrinting CUPS (all versions through 2.4.20) lets an authorized print submitter stall the scheduler's job-timeout handling, so incomplete jobs accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The defect in cupsdCheckJobs() suppresses submission-timeout processing for every pending job whenever any client connection holds an in-flight Send-Document operation, without matching that connection to the job being examined (CWE-770); per the independent assessment the attack surface is AV:N/AC:L with PR:L, meaning the attacker must already be a principal permitted to reach the IPP/HTTP service and allowed to submit Create-Job requests, not an anonymous outsider. Impact is transient and self-correcting once the held connection closes, with no persistence, data exposure, or effect beyond blocking new jobs; no public exploit code and no CISA KEV activity were identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue.
CVE-2026-55480 is currently recorded only against Ubuntu Linux, with the sole intelligence signal being that the entry was reported by vendor:ubuntu, meaning Canonical's security team is the originating source for the record. The supplied data contains no description, no CVSS score or vector, no CWE classification, no CPE strings, and no version ranges, so the specific component, attack vector, authentication requirement, and impact cannot be characterized at this time. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this reflects the absence of data rather than a confirmed negative - defenders should treat the entry as unassessed and pull the authoritative record from the Ubuntu CVE tracker and NVD before drawing any risk conclusion.
Ubuntu Linux carries CVE-2026-55453, a security issue that has so far been reported only by the vendor (Ubuntu) with no published description, no CVSS score or vector, no CWE classification, and no CPE or version data. Because the flaw is entirely undisclosed, it is not possible to state which package, subsystem, or Ubuntu release is affected, what an attacker would need to reach it, or what the resulting impact would be. There is no public exploit identified at time of analysis, no KEV listing, no EPSS score, and no confirmed patch availability, so the item should be treated as an unassessed placeholder pending the corresponding Ubuntu Security Notice (USN) and NVD entry.
CVE-2026-61702 is recorded in this dataset solely as a vendor-sourced report from Ubuntu, with no description, no CVSS score or vector, no CWE mapping, and no CPE data, so the specific Ubuntu package, upstream component, and version range involved cannot be identified. Because the description is '[Unknown description]', no attacker capability, impact, or exploitation precondition can be stated, and the EPSS, KEV, and proof-of-concept signals are all absent - there is no evidence of active exploitation and no public exploit code identified at time of analysis, though that absence reflects missing data rather than a positive finding of safety. Risk cannot be meaningfully assessed from the provided data because nearly every decision signal is absent; prioritization should be deferred until the Ubuntu Security Notice and canonical CVE description are retrieved.
Argument injection in the OpenPrinting CUPS mailto notifier can let a low-privileged user or authorized subscription creator influence the configured sendmail command when CUPS email notifications are enabled. Exploitation requires a crafted notify-recipient-uri beginning with '-' and an MTA that interprets it as an option; the assessed risk is low because email notification is non-default, CUPS is typically local-only (AV:L), complexity is high, and impact is limited to low confidentiality and integrity in the assessed vector. No public exploit identified at time of analysis. Affected deployments include upstream OpenPrinting CUPS and CUPS in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images.
OpenPrinting CUPS before version 2.4.17 allows network-adjacent attackers to read up to 176 bytes of stack memory via a crafted SNMP response sent to the CUPS SNMP backend, with leaked data visible to authenticated users through IPP Get-Printer-Attributes responses and the web interface. The vulnerability requires adjacency on the network but no authentication, making it a low-severity information disclosure risk in environments where SNMP-enabled printers are accessible from untrusted networks.
Local denial of service and potential remote code execution in OpenPrinting CUPS 2.4.16 and prior occurs when the scheduler (cupsd) deletes temporary printers without expiring associated subscriptions, leaving dangling pointers in memory that are subsequently dereferenced. An unauthenticated local attacker can crash the cupsd daemon or, with heap grooming techniques, achieve arbitrary code execution on systems running affected CUPS versions.
Denial of service in OpenPrinting CUPS 2.4.16 and prior allows unprivileged local users to crash the cupsd root process via integer underflow in _ppdCreateFromIPP() by supplying a negative job-password-supported IPP attribute, which wraps to a large size_t value and triggers a stack buffer overflow in memset(). When combined with systemd's automatic restart mechanism, an attacker can sustain repeated crashes without requiring elevated privileges or user interaction.
Unauthenticated remote code execution in OpenPrinting CUPS 2.4.16 and earlier allows attackers to send print jobs to shared PostScript queues without authentication, exploit a newline injection vulnerability in page-border parameter handling, and execute arbitrary binaries as the lp user by chaining a follow-up raw print job. CISA KEV status and active exploitation confirmation not provided; no publicly available patches identified at publication.
Heap-based buffer overflow in OpenPrinting CUPS scheduler versions 2.4.16 and prior allows unauthenticated remote attackers to trigger a denial of service condition by crafting malicious job attributes that overflow buffers during filter option string construction. With a CVSS score of 5.3 and network accessibility, this vulnerability impacts availability on exposed CUPS instances; no public exploit code or vendor patch has been released as of publication.
Path traversal in OpenPrinting CUPS RSS notifier (versions 2.4.16 and prior) allows unauthenticated remote IPP clients to write arbitrary files outside the intended CacheDir/rss directory via a crafted notify-recipient-uri parameter. By exploiting default group-writable permissions on CacheDir, attackers can overwrite critical state files such as job.cache, causing the CUPS scheduler to fail parsing job queues and resulting in loss of previously queued print jobs. No public exploit code or vendor patch is currently available, though the vulnerability is demonstrated with proof-of-concept exploitation.
Local privilege escalation in OpenPrinting CUPS 2.4.16 and prior allows unprivileged users to bypass authentication and create arbitrary file overwrites as root by coercing cupsd into issuing reusable Authorization tokens and leveraging printer-sharing policies to persist file:// URIs that bypass FileDevice restrictions. A proof-of-concept demonstrates root command execution via sudoers file modification, and the vulnerability is confirmed by the presence of public exploit code.
CUPS daemon (cupsd) versions 2.4.16 and earlier authenticate users via case-insensitive username comparison, allowing an authenticated high-privileged user to bypass authorization controls by submitting requests under a username that differs only in case from an authorized user, gaining access to restricted printing operations. No public exploit code has been identified, and patches were not available at the time of initial disclosure, though a upstream commit indicates a fix may have been prepared.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2,. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 58.8%.
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py. Rated low severity (CVSS 1.9).
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. Rated low severity (CVSS 1.5).
The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/. Rated low severity (CVSS 1.2). No vendor patch available.
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving. Rated low severity (CVSS 1.2). Public exploit code available and no vendor patch available.
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 10.2%.
Alpine Linux has issued a fix for an unspecified vulnerability in the CUPS printing package, addressed in cups version 2.4.20-r0. The advisory provides no description of the flaw, its impact, or attack vector; consequently, the risk cannot be meaningfully quantified, and authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Null pointer dereference in OpenPrinting CUPS allows unauthenticated remote attackers who can submit jobs to a shared printer queue to crash the cupsd print daemon, causing a temporary denial of service for all printing services. Exploitation requires a vulnerable version that still ships the deprecated embedded job-ticket comment feature and a single crafted PostScript or PDF file submitted via the Print-Job operation whose first lines contain a malformed %cupsJobTicket: entry. Impact is bounded to a brief daemon crash with automatic restart-there is no code execution or data exposure-and no public exploit code has been identified at time of analysis.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a crafted Print-Job IPP request terminate the cupsd scheduler, taking every queue it serves offline with it. Repeated IPP group tags cause the parser to create unnamed separator attributes (IPP_TAG_ZERO) that add_job() re-tags as IPP_TAG_JOB; when the job starts, get_options()/ipp_length() calls strlen() on the NULL attribute name and crashes the daemon (CWE-476). The vendor scores this 3.3 on a local vector, while our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, since an attacker who can reach the scheduler and submit to an enabled, accepting queue supporting the submitted document format can cause it; PR:L in the assessed vector indicates authenticated access is normally required, with anonymous submission possible only where listener and access-control configuration explicitly allow it. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a low-severity availability issue rather than an urgent priority for most environments.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a local, low-privileged user crash the cupsd scheduler by submitting a print job with the job-held-on-create attribute that references a temporary printer, which can then be auto-deleted while the held job still references it, triggering a NULL pointer dereference in cupsdCheckJobs(). The crash occurs when cupsdFindDest() returns NULL during the holding_new_jobs check, terminating cupsd and interrupting every queue it manages. Exploitation requires the temporary-printer feature (auto-created for shared or network-discovered destinations) to be in use and depends on timing between held-job submission and automatic printer cleanup, giving high attack complexity (AC:H) and availability-only impact (CVSS 5.1, C:N/I:N/A:H); no public exploit code has been identified at time of analysis.
Denial of service in OpenPrinting CUPS before 2.4.20 lets an actor holding @SYSTEM-level class-management privileges crash the cupsd scheduler by triggering a double-free in printer-class handling. The actor submits a CUPS-Add-Modify-Class request that replaces an existing class's member list and then fails subsequent validation, leaving pclass->printers as a dangling pointer, then issues a CUPS-Delete-Class request so cupsdDeletePrinter() frees the same allocation a second time. Impact is confined to availability (scheduler crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis - the @SYSTEM privilege prerequisite (PR:H) is the dominant limiting factor, keeping overall risk low even though the assessed vector is network-reachable (AV:N/AC:H) when the CUPS listener is exposed.
Resource exhaustion in OpenPrinting CUPS (all versions through 2.4.20) lets an authorized print submitter stall the scheduler's job-timeout handling, so incomplete jobs accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The defect in cupsdCheckJobs() suppresses submission-timeout processing for every pending job whenever any client connection holds an in-flight Send-Document operation, without matching that connection to the job being examined (CWE-770); per the independent assessment the attack surface is AV:N/AC:L with PR:L, meaning the attacker must already be a principal permitted to reach the IPP/HTTP service and allowed to submit Create-Job requests, not an anonymous outsider. Impact is transient and self-correcting once the held connection closes, with no persistence, data exposure, or effect beyond blocking new jobs; no public exploit code and no CISA KEV activity were identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue.
CVE-2026-55480 is currently recorded only against Ubuntu Linux, with the sole intelligence signal being that the entry was reported by vendor:ubuntu, meaning Canonical's security team is the originating source for the record. The supplied data contains no description, no CVSS score or vector, no CWE classification, no CPE strings, and no version ranges, so the specific component, attack vector, authentication requirement, and impact cannot be characterized at this time. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this reflects the absence of data rather than a confirmed negative - defenders should treat the entry as unassessed and pull the authoritative record from the Ubuntu CVE tracker and NVD before drawing any risk conclusion.
Ubuntu Linux carries CVE-2026-55453, a security issue that has so far been reported only by the vendor (Ubuntu) with no published description, no CVSS score or vector, no CWE classification, and no CPE or version data. Because the flaw is entirely undisclosed, it is not possible to state which package, subsystem, or Ubuntu release is affected, what an attacker would need to reach it, or what the resulting impact would be. There is no public exploit identified at time of analysis, no KEV listing, no EPSS score, and no confirmed patch availability, so the item should be treated as an unassessed placeholder pending the corresponding Ubuntu Security Notice (USN) and NVD entry.
CVE-2026-61702 is recorded in this dataset solely as a vendor-sourced report from Ubuntu, with no description, no CVSS score or vector, no CWE mapping, and no CPE data, so the specific Ubuntu package, upstream component, and version range involved cannot be identified. Because the description is '[Unknown description]', no attacker capability, impact, or exploitation precondition can be stated, and the EPSS, KEV, and proof-of-concept signals are all absent - there is no evidence of active exploitation and no public exploit code identified at time of analysis, though that absence reflects missing data rather than a positive finding of safety. Risk cannot be meaningfully assessed from the provided data because nearly every decision signal is absent; prioritization should be deferred until the Ubuntu Security Notice and canonical CVE description are retrieved.
Argument injection in the OpenPrinting CUPS mailto notifier can let a low-privileged user or authorized subscription creator influence the configured sendmail command when CUPS email notifications are enabled. Exploitation requires a crafted notify-recipient-uri beginning with '-' and an MTA that interprets it as an option; the assessed risk is low because email notification is non-default, CUPS is typically local-only (AV:L), complexity is high, and impact is limited to low confidentiality and integrity in the assessed vector. No public exploit identified at time of analysis. Affected deployments include upstream OpenPrinting CUPS and CUPS in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images.
OpenPrinting CUPS before version 2.4.17 allows network-adjacent attackers to read up to 176 bytes of stack memory via a crafted SNMP response sent to the CUPS SNMP backend, with leaked data visible to authenticated users through IPP Get-Printer-Attributes responses and the web interface. The vulnerability requires adjacency on the network but no authentication, making it a low-severity information disclosure risk in environments where SNMP-enabled printers are accessible from untrusted networks.
Local denial of service and potential remote code execution in OpenPrinting CUPS 2.4.16 and prior occurs when the scheduler (cupsd) deletes temporary printers without expiring associated subscriptions, leaving dangling pointers in memory that are subsequently dereferenced. An unauthenticated local attacker can crash the cupsd daemon or, with heap grooming techniques, achieve arbitrary code execution on systems running affected CUPS versions.
Denial of service in OpenPrinting CUPS 2.4.16 and prior allows unprivileged local users to crash the cupsd root process via integer underflow in _ppdCreateFromIPP() by supplying a negative job-password-supported IPP attribute, which wraps to a large size_t value and triggers a stack buffer overflow in memset(). When combined with systemd's automatic restart mechanism, an attacker can sustain repeated crashes without requiring elevated privileges or user interaction.
Unauthenticated remote code execution in OpenPrinting CUPS 2.4.16 and earlier allows attackers to send print jobs to shared PostScript queues without authentication, exploit a newline injection vulnerability in page-border parameter handling, and execute arbitrary binaries as the lp user by chaining a follow-up raw print job. CISA KEV status and active exploitation confirmation not provided; no publicly available patches identified at publication.
Heap-based buffer overflow in OpenPrinting CUPS scheduler versions 2.4.16 and prior allows unauthenticated remote attackers to trigger a denial of service condition by crafting malicious job attributes that overflow buffers during filter option string construction. With a CVSS score of 5.3 and network accessibility, this vulnerability impacts availability on exposed CUPS instances; no public exploit code or vendor patch has been released as of publication.
Path traversal in OpenPrinting CUPS RSS notifier (versions 2.4.16 and prior) allows unauthenticated remote IPP clients to write arbitrary files outside the intended CacheDir/rss directory via a crafted notify-recipient-uri parameter. By exploiting default group-writable permissions on CacheDir, attackers can overwrite critical state files such as job.cache, causing the CUPS scheduler to fail parsing job queues and resulting in loss of previously queued print jobs. No public exploit code or vendor patch is currently available, though the vulnerability is demonstrated with proof-of-concept exploitation.
Local privilege escalation in OpenPrinting CUPS 2.4.16 and prior allows unprivileged users to bypass authentication and create arbitrary file overwrites as root by coercing cupsd into issuing reusable Authorization tokens and leveraging printer-sharing policies to persist file:// URIs that bypass FileDevice restrictions. A proof-of-concept demonstrates root command execution via sudoers file modification, and the vulnerability is confirmed by the presence of public exploit code.
CUPS daemon (cupsd) versions 2.4.16 and earlier authenticate users via case-insensitive username comparison, allowing an authenticated high-privileged user to bypass authorization controls by submitting requests under a username that differs only in case from an authorized user, gaining access to restricted printing operations. No public exploit code has been identified, and patches were not available at the time of initial disclosure, though a upstream commit indicates a fix may have been prepared.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available.
OpenPrinting CUPS is an open source printing system. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A logic issue was addressed with improved state management. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2,. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 58.8%.
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py. Rated low severity (CVSS 1.9).
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. Rated low severity (CVSS 1.5).
The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/. Rated low severity (CVSS 1.2). No vendor patch available.
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving. Rated low severity (CVSS 1.2). Public exploit code available and no vendor patch available.
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 10.2%.
Alpine Linux has issued a fix for an unspecified vulnerability in the CUPS printing package, addressed in cups version 2.4.20-r0. The advisory provides no description of the flaw, its impact, or attack vector; consequently, the risk cannot be meaningfully quantified, and authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).