CVE-2014-9679: apple cups

CVSS: 6.8v2.0MediumModified

AliasesMGASA-2015-0067SUSE-SU-2015:0465-1UBUNTU-CVE-2014-9679+4 more

Published 19-02-2015Last modified 06-08-2024

Vulnerability summary

CVE-2014-9679 is a medium (CVSS 6.8) vulnerability in apple cups. EPSS estimates a 4.63% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

4.63%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2015:1123

Timeline

19-02-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

4.63%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.63% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Suse5 products

cups154&distro=SUSE Linux Enterprise Module for Legacy 12< 1.5.4-5.1
cups&distro=SUSE Linux Enterprise Desktop 12< 1.7.5-5.1
cups&distro=SUSE Linux Enterprise Server 12< 1.7.5-5.1
cups&distro=SUSE Linux Enterprise Server for SAP Applications 12< 1.7.5-5.1
cups&distro=SUSE Linux Enterprise Software Development Kit 12< 1.7.5-5.1

Apple1 product

cups≤ 2.0.1

Debian1 product

cups< 1.7.5-11 | < 1.4.4-7+squeeze7 | < 1.5.3-5+deb7u5

Mageia1 product

cups< 1.7.0-7.4.mga4

Ubuntu1 product

cups< 1.7.2-0ubuntu1.5

5 vendors · 9 products

References

26 links

rhn.redhat.com/errata/RHSA-2015-1123.htmlVendor AdvisoryX Refsource REDHAT
www.cups.org/str.php?L4551X Refsource CONFIRMVendor AdvisoryWEB
www.openwall.com/lists/oss-security/2015/02/10/15Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
www.ubuntu.com/usn/USN-2520-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-02/msg00098.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2015:049Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
security.gentoo.org/glsa/201607-06Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-February/150177.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securitytracker.com/id/1031776VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 26 references

lists.fedoraproject.org/pipermail/package-announce/2015-February/150171.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.debian.org/security/2015/dsa-3172Vendor AdvisoryX Refsource DEBIANThird Party Advisory
advisories.mageia.org/MGASA-2015-0067.htmlX Refsource CONFIRMThird Party Advisory
www.openwall.com/lists/oss-security/2015/02/12/12Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
www.mandriva.com/security/advisories?name=MDVSA-2015:108Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.securityfocus.com/bid/72594VDB EntryX Refsource BIDThird Party Advisory
advisories.mageia.org/MGASA-2015-0067.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=15260REPORT
openwall.com/lists/oss-security/2015/02/12/12WEB
www.suse.com/support/update/announcement/2015/suse-su-20150465-1/Advisory
bugzilla.suse.com/917799REPORT
www.suse.com/security/cve/CVE-2014-9679WEB
ubuntu.com/security/CVE-2014-9679REPORT
ubuntu.com/security/notices/USN-2520-1Advisory
www.cve.org/CVERecord?id=CVE-2014-9679REPORT
security-tracker.debian.org/tracker/CVE-2014-9679Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities