Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-5377 — Link Following in Apple Cups

CWE-59 — Link Following8 documents8 sources
Severity
6.9MEDIUMNVD
CNA1.2OSV1.2
EPSS
0.2%
top 54.81%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apple Cups
Timeline
PublishedDec 8
Latest updateMay 17

Description

pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333.

CVSS vector

AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0

Affected Packages2 packages

▶Debianapple/cups< 1.3.8-1lenny1+3
▶NVDapple/cups1.3.8

🔴Vulnerability Details

3
GHSA
GHSA-4fjp-m2ph-c7hw: pstopdf in CUPS 1↗2022-05-17
▶
OSV
CVE-2008-5377: pstopdf in CUPS 1↗2008-12-08
▶
CVEList
CVE-2008-5377: pstopdf in CUPS 1↗2008-12-08
▶

💥Exploits & PoCs

1
Exploit-DB
CUPS < 1.3.8-4 - Local Privilege Escalation↗2008-12-22
▶

📋Vendor Advisories

3
Ubuntu
CUPS vulnerabilities↗2009-01-12
▶
Debian
CVE-2008-5377: cups - pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a syml...↗2008
▶
Red Hat
CVE-2008-5377: pstopdf in CUPS 1↗
▶
CVE-2008-5377 — Link Following in Apple Cups | cvebase