CVE-2008-2940: High severity HP Linux Imaging and Printing Project vulnerability
The alert-mailing implementation in HP Linux Imaging and Printing (HPLIP) 1.6.7 allows local users to gain privileges and send e-mail messages from the root account via vectors related to the setalerts message, and lack of validation of the device URI associated with an event message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/hplipto a version that resolves this vulnerability.Fixed in 2.8.6-1 - Upgrade
Upgrade
debian/hplipto a version that resolves this vulnerability.Fixed in 3.22.10+dfsg0-2Fixed in 3.22.10+dfsg0-2+deb12u1Fixed in 3.22.10+dfsg0-8.1+deb13u1Fixed in 3.26.4+dfsg0-4
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2940?
CVE-2008-2940 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2008-2940?
Fix CVE-2008-2940 by upgrading to a patched version of HP Linux Imaging and Printing beyond 1.6.7.
Who is affected by CVE-2008-2940?
Local users of HP Linux Imaging and Printing version 1.6.7 are affected by CVE-2008-2940.
What kind of attack vector is associated with CVE-2008-2940?
CVE-2008-2940 allows local users to gain privileges through the alert-mailing implementation.
What is the main issue with CVE-2008-2940?
The main issue with CVE-2008-2940 is the lack of validation of the device URI in the setalerts message.