NVD

Id
23544  
Name
CVE-2015-1158  
Description
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-02-28  
Published
2015-06-26  
Modified Date
2017-02-23  
Seq
2015-1158  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
124754 23544 CVE-2015-1158 http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html  View
124755 23544 CVE-2015-1158 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702  View
124756 23544 CVE-2015-1158 SUSE-SU-2015:1041  View
124757 23544 CVE-2015-1158 SUSE-SU-2015:1044  View
124758 23544 CVE-2015-1158 openSUSE-SU-2015:1056  View
124759 23544 CVE-2015-1158 RHSA-2015:1123  View
124760 23544 CVE-2015-1158 http://www.cups.org/blog.php?L1082  View
124761 23544 CVE-2015-1158 DSA-3283  View
124762 23544 CVE-2015-1158 VU#810572  View
124763 23544 CVE-2015-1158 75098  View
124764 23544 CVE-2015-1158 USN-2629-1  View
124765 23544 CVE-2015-1158 https://bugzilla.opensuse.org/show_bug.cgi?id=924208  View
124766 23544 CVE-2015-1158 https://bugzilla.redhat.com/show_bug.cgi?id=1221641  View
124767 23544 CVE-2015-1158 https://code.google.com/p/google-security-research/issues/detail?id=455  View
124768 23544 CVE-2015-1158 GLSA-201510-07  View
124769 23544 CVE-2015-1158 https://www.cups.org/str.php?L4609  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7961 JVNDB-2015-003281 CUPS の cupsd の scheduler/ipp.c 内の add_job 関数における参照カウントの文字列のデータ破損を誘発される脆弱性 CUPS の cupsd の scheduler/ipp.c 内の add_job 関数は、multiple-value の job-originating-host-name 属性の不正な操作を実行するため、参照カウントの文字列のデータ破損を誘発される脆弱性が存在します。 CVE-2015-1158 78383 CVE-2015-1158 23544 10 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003281.html 2015-06-09 2015-06-29 View