CVE-2015-1159

Published: 9 June 2015

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Priority

Status

Package	Release	Status
cups Launchpad, Ubuntu, Debian	vivid	Released (2.0.2-1ubuntu3.1)
	upstream	Needs triage
	precise	Released (1.5.3-0ubuntu8.7)
	trusty	Does not exist (trusty was released [1.7.2-0ubuntu1.6])
	utopic	Released (1.7.5-3ubuntu3.2)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159
http://www.kb.cert.org/vuls/id/810572
https://ubuntu.com/security/notices/USN-2629-1
NVD
Launchpad
Debian

Bugs

https://www.cups.org/str.php?L4609

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›