Univention Bugzilla – Bug 35402
cups: Multiple issues (3.2)
Last modified: 2017-02-20 20:49:09 CET
CVE-2014-2856: Cross-site scripting in the we interface
(In reply to Moritz Muehlenhoff from comment #0) > CVE-2014-2856: Cross-site scripting in the web interface The original upstream fix was incomplete; three additional CVE IDs have been assigned: CVE-2014-5031 CVE-2014-5030 CVE-2014-5029
CVE-2014-9679: buffer overflow in cupsRasterReadPixels
CVE-2014-3537 Cups features a built-in RSS mechanism to notify users of the print scheduler status. The CUPS web server serves requests to any URL starting with "/rss" with the respecitive file below /var/cache/cups/rss/. This directory is writable by the group "sys" and the CUPS web server follows symlinks, i.e. it would be possible to symlink to e.g. /etc/machine.secret. The impact on UCS is rather low: "sys" is a local group and empty by default.
*** Bug 35357 has been marked as a duplicate of this bug. ***
Fixed in upstream Debian package version 1.4.4-7+squeeze7
Fixed in upstream Debian package version 1.4.4-7+squeeze8: * Improper Update of Reference Count (CVE-2015-1158) * Cross-Site Scripting (CVE-2015-1159)
*** This bug has been marked as a duplicate of bug 39401 ***
OK