CVE Feed

    Dashboard / CVE / CVE-2015-1158

    CVE-2015-1158

    The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

    Published:Jun 10, 2015
    Last Modified:Apr 12, 2025
    EPS:Jun 26, 2015
    EPSS Score:0.76998
    CVSS Score:10

    Affected Products

    Vendor
    Cups
    Product
    Cups
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    https://www.exploit-db.com/exploits/41233https://www.exploit-db.com/exploits/37336

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-47850 (CVSS 7.5) — CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response…
    CVE-2018-6553 (CVSS 8.8) — The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker co…
    CVE-2015-1159 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine…
    CVE-2014-8166 (CVSS 8.8) — The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, wh…
    CVE-2008-1722 (CVSS 4.3) — Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers t…
    CVE-2008-0047 (CVSS 9.3) — Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the ve…
    CVE-2008-0882 (CVSS 10) — Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a…
    CVE-2007-4351 (CVSS 10) — Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a deni…
    CVE-2007-0720 (CVSS 5) — The CUPS service on multiple platforms allows remote attackers to cause a denial of service (service hang) via…
    CVE-2005-4873 (CVSS 7.5) — Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-depende…

    References

    http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702
    http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
    http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html
    http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html
    http://rhn.redhat.com/errata/RHSA-2015-1123.html
    http://www.cups.org/blog.php?L1082
    http://www.debian.org/security/2015/dsa-3283
    http://www.kb.cert.org/vuls/id/810572
    http://www.securityfocus.com/bid/75098
    http://www.securitytracker.com/id/1032556
    http://www.ubuntu.com/usn/USN-2629-1
    https://bugzilla.opensuse.org/show_bug.cgi?id=924208
    https://bugzilla.redhat.com/show_bug.cgi?id=1221641
    https://code.google.com/p/google-security-research/issues/detail?id=455
    https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py
    https://security.gentoo.org/glsa/201510-07
    https://www.cups.org/str.php?L4609
    https://www.exploit-db.com/exploits/37336/
    https://www.exploit-db.com/exploits/41233/
    http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702
    http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
    http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html
    http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html
    http://rhn.redhat.com/errata/RHSA-2015-1123.html
    http://www.cups.org/blog.php?L1082
    http://www.debian.org/security/2015/dsa-3283
    http://www.kb.cert.org/vuls/id/810572
    http://www.securityfocus.com/bid/75098
    http://www.securitytracker.com/id/1032556
    http://www.ubuntu.com/usn/USN-2629-1
    https://bugzilla.opensuse.org/show_bug.cgi?id=924208
    https://bugzilla.redhat.com/show_bug.cgi?id=1221641
    https://code.google.com/p/google-security-research/issues/detail?id=455
    https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py
    https://security.gentoo.org/glsa/201510-07
    https://www.cups.org/str.php?L4609
    https://www.exploit-db.com/exploits/37336/
    https://www.exploit-db.com/exploits/41233/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High