The following flaw was found in CUPS: Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a result, an attacker can prematurely free an arbitrary string of global scope. They can use this to dismantle ACLs protecting privileged operations, and upload a replacement configuration file, and subsequently run arbitrary code on a target machine. This bug is exploitable in default configurations, and does not require any special permissions other than the basic ability to print. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158
