Fluid Attacks Database

Description

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	cups	>=0 <1.5.3-2.7	1.5.3-2.7
debian 14	cups	>=0 <1.5.3-2.7	1.5.3-2.7
debian 13	cups	>=0 <1.5.3-2.7	1.5.3-2.7
rpm rhel5	cups	<1:1.3.7-30.el5_9.3	1:1.3.7-30.el5_9.3
rpm rhel6	cups	<1:1.4.2-50.el6_4.4	1:1.4.2-50.el6_4.4

Aliases

1. CVE-2012-55192. NVD-2012-55193. OSV-DEBIAN-2012-55194. OSV-2012-55195. SECURITY-TRACKER-CVE-2012-5519

References

1. https://github.com/p1ckzi/CVE-2012-5519

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.