CVE-2014-5030

NameCVE-2014-5030
DescriptionCUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-0022-1, DSA-2990-1
NVD severitylow (attack range: local)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)wheezy, wheezy (security)1.5.3-5+deb7u6fixed
jessie (security), jessie1.7.5-11+deb8u1fixed
stretch2.2.1-8fixed
buster2.2.4-7fixed
sid2.2.5-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssource(unstable)1.7.4-2low
cupssourcesqueeze1.4.4-7+squeeze6low
cupssourcewheezy1.5.3-5+deb7u4lowDSA-2990-1

Notes

https://cups.org/str.php?L4455

Search for package or bug name: Reporting problems