CVE-2015-1158

High

Published: 26/06/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The add_job function in cupsd in CUPS before version 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, allowing remote attackers to trigger data corruption.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code on the server, posing a serious threat to system integrity.

Recommendation

It is recommended to upgrade CUPS to version 2.0.3 or later to mitigate this vulnerability.

Other vulnerabilities in CUPS (Common Unix Printing System)

CVE-2023-34241Medium
CUPS versions from 2.0.0 to 2.4.6 contain a use-after-free bug that causes logging of free memory data after the connection has been closed, instead of before. This issue affects the entire cupsd process.

Original NVD description (English source)

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.