Wind River Support Network

HomeDefectsLIN8-9665
Fixed

LIN8-9665 : Security Advisory - cups - CVE-2018-4180

Created: Aug 15, 2018    Updated: Feb 2, 2019
Resolved Date: Aug 20, 2018
Found In Version: 8.0.0.26
Fix Version: 8.0.0.27
Severity: Standard
Applicable for: Wind River Linux 8
Component/s: Userspace

Description

Affected versions of CUPS allow for the SetEnv and PassEnv directives to be specified in the cupsd.conf file, which is editable by non-root users using the cupsctl binary.  This allows attacker-controlled environment variables to be passed to CUPS backends, some of which are run as root.  By passing malicious values in environment variables to affected backends, it is possible to execute an attacker-supplied binary as root, subject to sandbox restrictions.

https://nvd.nist.gov/vuln/detail/CVE-2018-4180 

Other Downloads


CVEs


Live chat
Online