CVE-2015-1158: cups 7PK - Security Features

Vulnerability summary

CVE-2015-1158 is a high (CVSS 10.0) 7PK - Security Features vulnerability in cups. EPSS estimates a 29.73% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 26-06-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

• CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.