lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.

Aaron Sigel of Apple Product Security reported that CUPS did not check Host: HTTP header in the connections to the daemon. This insufficient checking may be of an advantage as part of some other attack, e.g. DNS rebinding attack (however, for such attack, user's web browser or browser plugin must be prone to the DNS rebinding attack).

Upstream patch adds check for the Host: header used in clients' requests. It also introduced ServerAlias configuration directive, that must be used to allow clients to use additional valid host names besides those set has hostname or hostname's aliases.