K16794: CUPS vulnerabilities CVE-2015-1158 / CVE-2015-1159

Security Advisory Description Description CVE-2015-1158 A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement...

SUSE CVE-2003-0195

CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port 631, which does not time out...

SUSE CVE-2003-0788

Unknown vulnerability in the Internet Printing Protocol IPP implementation in CUPS before 1.1.19 allows remote attackers to cause a denial of service CPU consumption from a "busy loop" via certain inputs to the IPP port TCP 631...

SUSE CVE-2004-0558

The Internet Printing Protocol IPP implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service service hang via a certain UDP packet to the IPP port...

SUSE CVE-2004-0889

Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service crash and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888...

SUSE CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

SUSE CVE-2004-1270

lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers...

SUSE CVE-2004-1268

lppasswd in CUPS 1.1.22 ignores write errors when modifying the CUPS passwd file, which allows local users to corrupt the file by filling the associated file system and triggering the write errors...

SUSE CVE-2005-3626

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service crash via a crafted FlateDecode stream that triggers a null dereference...

SUSE CVE-2007-5849

Integer underflow in the asn1getstring function in the SNMP back end backend/snmp.c for CUPS 1.2 through 1.3.4 allows remote attackers to execute arbitrary code via a crafted SNMP response that triggers a stack-based buffer overflow...

SUSE CVE-2008-0597

Use-after-free vulnerability in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service crash via crafted IPP packets...

SUSE CVE-2008-0596

Memory leak in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service memory consumption and daemon crash via a large number of requests to add and remove shared printers...

SUSE CVE-2008-0882

Double free vulnerability in the processbrowsedata function in CUPS 1.3.5 allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port 631/udp, related to an unspecified manipulation of a remote printer. NOT...

SUSE CVE-2008-1722

Multiple integer overflows in 1 filter/image-png.c and 2 filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service crash and trigger memory corruption, as demonstrated via a crafted PNG image...

SUSE CVE-2008-3639

Heap-based buffer overflow in the readrle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded RLE data containing a small image and a large row count...

SUSE CVE-2008-5184

The web interface cgi-bin/admin.c in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the 1 add and 2 cancel RSS subscription functions...

SUSE CVE-2008-5286

Integer overflow in the cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow...

SUSE CVE-2009-0164

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...

SUSE CVE-2009-0163

Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the 1 cupsImageReadTIFF function in the imagetops filter...

SUSE CVE-2009-0195

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments...