REDHAT-BUG-1607284

First published: Mon Jul 23 2018(Updated: )

The sandbox profile dynamically generated by cupsdCreateProfile() unintentionally allows write access to /etc/cups. This can be used by an attacker that has obtained sandboxed root access to alter /etc/cups/cups-files.conf, leading to unsandboxed root code execution. References: <a href="https://blog.gdssecurity.com/labs/2018/7/11/cups-local-privilege-escalation-and-sandbox-escapes.html">https://blog.gdssecurity.com/labs/2018/7/11/cups-local-privilege-escalation-and-sandbox-escapes.html</a> Upstream patch: <a href="https://github.com/apple/cups/commit/d47f6aec436e0e9df6554436e391471097686ecc">https://github.com/apple/cups/commit/d47f6aec436e0e9df6554436e391471097686ecc</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2018-4183
• agent/type
• agent/references
• agent/last-modified-date
• agent/severity
• agent/description
• agent/first-publish-date
• agent/event
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/apple
• canonical/apple cups