CVE-2015-1158

NameCVE-2015-1158
DescriptionThe add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-239-1, DSA-3283-1
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)wheezy, wheezy (security)1.5.3-5+deb7u6fixed
jessie (security), jessie1.7.5-11+deb8u1fixed
stretch2.2.1-8fixed
buster2.2.4-7fixed
sid2.2.5-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssource(unstable)1.7.5-12high
cupssourcejessie1.7.5-11+deb8u1highDSA-3283-1
cupssourcesqueeze1.4.4-7+squeeze8highDLA-239-1
cupssourcewheezy1.5.3-5+deb7u6highDSA-3283-1

Search for package or bug name: Reporting problems