CVE-2014-4336 — Command Injection in Cups-filters

CWE-77 — Command Injection8 documents7 sources
Severity
5.8MEDIUMNVD
CNA8.3OSV8.3
EPSS
0.5%
top 33.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Linuxfoundation Cups-filters
Timeline
PublishedJun 22
Latest updateMay 14

Description

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

CVSS vector

AV:A/AC:L/C:P/I:P/A:PExploitability: 6.5 | Impact: 6.4

Affected Packages2 packages

▶Debianlinuxfoundation/cups-filters< 1.0.53-1+3

Patches

Patch: bzr.linuxfoundation.org ↗Patch: openwall.com ↗Patch: bzr.linuxfoundation.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-w4jh-3cpq-48pp: The generate_local_queue function in utils/cups-browsed↗2022-05-14
▶
CVEList
CVE-2014-4336: The generate_local_queue function in utils/cups-browsed↗2014-06-22
▶
OSV
CVE-2014-4336: The generate_local_queue function in utils/cups-browsed↗2014-06-22
▶

📋Vendor Advisories

2
Red Hat
cups-filters: incomplete fix for CVE-2014-2707↗2014-04-23
▶
Debian
CVE-2014-4336: cups-filters - The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cup...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-4337 cups-filters: cups-browsed DoS via process_browse_data() OOB read↗2014-06-20
▶
Bugzilla
CVE-2014-4336 cups-filters: incomplete fix for CVE-2014-2707↗2014-04-25
▶
CVE-2014-4336 — Command Injection in Cups-filters | cvebase