CVE-2014-5029

Publication date 29 July 2014

Last updated 24 July 2024

Ubuntu priority

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
cups	14.04 LTS trusty	Fixed 1.7.2-0ubuntu1.2
	12.04 LTS precise	Fixed 1.5.3-0ubuntu8.5
	10.04 LTS lucid	Fixed 1.4.3-1ubuntu1.13

Notes

mdeslaur

The patch below introduces a regression preventing the web interface from being able to read log files. (See comments in bug 4455.)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
cups	Upstream: https://cups.org/strfiles.php/3371/str4455-1.7.patch

References

Related Ubuntu Security Notices (USN)