Wind River Support Network


LIN8-9665 : Security Advisory - cups - CVE-2018-4180

Created: Aug 15, 2018    Updated: Feb 2, 2019
Resolved Date: Aug 20, 2018
Found In Version:
Fix Version:
Severity: Standard
Applicable for: Wind River Linux 8
Component/s: Userspace


Affected versions of CUPS allow for the SetEnv and PassEnv directives to be specified in the cupsd.conf file, which is editable by non-root users using the cupsctl binary.  This allows attacker-controlled environment variables to be passed to CUPS backends, some of which are run as root.  By passing malicious values in environment variables to affected backends, it is possible to execute an attacker-supplied binary as root, subject to sandbox restrictions. 

Other Downloads


Live chat