Wind River Support Network


LIN10-4544 : Security Advisory - cups - CVE-2018-4180

Created: Aug 15, 2018    Updated: Feb 2, 2019
Resolved Date: Aug 24, 2018
Found In Version:
Fix Version:
Severity: Standard
Applicable for: Wind River Linux LTS 17
Component/s: Userspace


Affected versions of CUPS allow for the SetEnv and PassEnv directives to be specified in the cupsd.conf file, which is editable by non-root users using the cupsctl binary.  This allows attacker-controlled environment variables to be passed to CUPS backends, some of which are run as root.  By passing malicious values in environment variables to affected backends, it is possible to execute an attacker-supplied binary as root, subject to sandbox restrictions. 

Other Downloads


Live chat