Arch Linux Security Advisory ASA-201506-2 ========================================= Severity: Critical Date : 2015-06-10 CVE-ID : CVE-2015-1158 CVE-2015-1159 Package : cups Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package cups before version 2.0.3-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation and cross-side scripting. Resolution ========== Upgrade to 2.0.3-1. # pacman -Syu "cups>=2.0.3-1" The problems have been fixed upstream in version 2.0.3. Workaround ========== None. Description =========== - CVE-2015-1158 (arbitrary code execution, privilege escalation) An issue with how localized strings are handled in cupsd allows a reference counter to over-decrement when handling certain print job request errors. As a result, an attacker can prematurely free an arbitrary string of global scope, creating a dangling pointer to a repurposed block of memory on the heap. The dangling pointer causes ACL verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL handling failure results in unrestricted access to privileged operations, allowing an unauthenticated remote user to upload a replacement CUPS configuration file and mount further attacks. - CVE-2015-1159 (cross-side scripting) A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. In certain cases, the CGI template can echo user input to file rather than escaping the text first. This may be used to set up a reflected XSS attack in the QUERY parameter of the web interface help page. By default, many linux distributions run with the web interface activated. Impact ====== A remote attacker is able to use a cross-side scripting flaw in order to send a malicious print request that is leading to arbitrary code execution and privilege escalation. References ========== https://www.cups.org/str.php?L4609 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159 https://bugs.archlinux.org/task/45279