REDHAT-BUG-1221642: XSS
First published: Thu May 14 2015(Updated: )
The following flaw was found in CUPS: A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. This XSS is reachable in the default configuration for Linux instances of CUPS, and allows an attacker to bypass default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface. Acknowledgements: Red Hat would like to thank the CERT/CC for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CUPS libraries |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cups.org/str.php?L4609
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1229979
- https://rhn.redhat.com/errata/RHSA-2015-1123.html
- http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html
- https://access.redhat.com/support/policy/updates/errata/
- https://bugzilla.redhat.com/show_bug.cgi?id=1221642
Frequently Asked Questions
What is the severity of REDHAT-BUG-1221642?
The severity of REDHAT-BUG-1221642 is considered high due to the potential for cross-site scripting (XSS) exploitation.
How do I fix REDHAT-BUG-1221642?
To fix REDHAT-BUG-1221642, you need to update your CUPS installation to the latest secure version provided by your distributor.
What versions of CUPS are affected by REDHAT-BUG-1221642?
REDHAT-BUG-1221642 affects the default configuration of Linux instances of CUPS widely in use.
Can REDHAT-BUG-1221642 be exploited without authentication?
Yes, REDHAT-BUG-1221642 can be exploited by an attacker without requiring user authentication due to the nature of the XSS vulnerability.
What are the potential impacts of REDHAT-BUG-1221642?
The potential impacts of REDHAT-BUG-1221642 include the ability for an attacker to execute arbitrary scripts in the context of the user's browser, leading to data theft or session hijacking.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-1159
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cups
- canonical/cups libraries