The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: debian
Published: 2014-07-29T14:00:00
Updated: 2017-01-04T17:57:01
Reserved: 2014-07-22T00:00:00
Link: CVE-2014-5029
JSON object: View
NVD Information
Status : Modified
Published: 2014-07-29T14:55:07.780
Modified: 2017-01-07T03:00:25.037
Link: CVE-2014-5029
JSON object: View
Redhat Information
No data.
CWE