CVE-2015-1159

Published: 9 June 2015

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Status

References

• http://www.kb.cert.org/vuls/id/810572
• https://ubuntu.com/security/notices/USN-2629-1
• https://www.cve.org/CVERecord?id=CVE-2015-1159
• NVD
• Launchpad
• Debian

Bugs

• https://www.cups.org/str.php?L4609