The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Severity: MEDIUM (5.8)

References:

Published: 2014-06-23
Modified: 2024-11-21

CVE-2014-4337

The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data.

Severity: MEDIUM (4.3)

References:

Published: 2014-06-23
Modified: 2024-11-21

CVE-2014-4338

cups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a malformed cups-browsed.conf BrowseAllow directive that is interpreted as granting browse access to all IP addresses.

Severity: MEDIUM (4.0)

References:

Version: 2.1.0

Package cups-filters update in sisyphus on 2014-05-16

ALT-PU-2014-1665-1

Closed vulnerabilities

BDU:2015-06081

BDU:2015-06082

BDU:2015-06083

BDU:2015-06084

BDU:2015-09199

BDU:2015-09200

BDU:2015-09201

BDU:2015-09202

CVE-2014-4336

CVE-2014-4337

CVE-2014-4338