Every CVE Search/ Get API key

CVE-2012-5519

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web...

7.2 HighPublic exploitFix available

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Exploit likelihood

2.13%Down 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
CVE-2012-5519
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
CVE-2012-5519
Updated
2026-11-02
EUVDEUVD-2012-5411 No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
EUVD-2012-5411
Updated
2026-11-03
GitHub AdvisoriesGHSA-ccjj-h3mm-j4rr No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web...

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
GHSA-ccjj-h3mm-j4rr
Updated
2026-11-02
OSV No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
CVE-2012-5519
Updated
2026-11-02
OSVDEBIAN-CVE-2012-5519 No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
DEBIAN-CVE-2012-5519
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:10075-1 No score

cups-2.1.3-2.3 on GA media

These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10075-1
Updated
2026-11-02
OSVSUSE-SU-2015:0575-1 No score

Security update for CUPS

This update fixes various issues in CUPS.

* CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various
  insufficient symbolic link checking could have lead to privilege
  escalation from the lp user to root.

Security Issues:

* CVE-2014-3537
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537>
* CVE-2014-5029
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029>
* CVE-2014-5030
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030>
* CVE-2014-5031
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031>
Record
SUSE-SU-2015:0575-1
Updated
2026-11-02
OSVSUSE-SU-2015:1011-1 No score

Security update for CUPS

This update fixes various issues in CUPS.

* CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various
  insufficient symbolic link checking could have lead to privilege
  escalation from the lp user to root.

Security Issues:

* CVE-2014-3537
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537>
* CVE-2014-5029
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029>
* CVE-2014-5030
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030>
* CVE-2014-5031
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031>
Record
SUSE-SU-2015:1011-1
Updated
2026-11-02
OSVSUSE-SU-2015:1041-1 No score

Security update for cups

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1041-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-1 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-2 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
 before 1.5.3-2.7
1.5.3-2.7
cups
Debian:13
 before 1.5.3-2.7
1.5.3-2.7
cups
Debian:14
 before 1.5.3-2.7
1.5.3-2.7
cups
Debian:6.0
 before 1.4.4-7+squeeze2, plus listed versions
1.4.4-71.4.4-7+squeeze1
1.4.4-7+squeeze2
cups
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-debuginfo
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-devel
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-libs
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-lpd
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
Show 29 moreShow less
Affected packages
PackageAffectedFixed
cups-debuginfo
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-debuginfo
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
SUSE:Linux Enterprise Desktop 12
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Software Development Kit 12
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server 12
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server for SAP Applications 12
 before 1.7.5-9.1
1.7.5-9.1
cups154
SUSE:Linux Enterprise Module for Legacy 12
 before 1.5.4-9.1
1.5.4-9.1
cups
openSUSE:Tumbleweed
 before 2.1.3-2.3
2.1.3-2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitCUPS 1.6.1 Root File Read2012-11-20
PoC in GitHubp1ckzi/CVE-2012-55192022-01-07

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5519 is a high vulnerability (CVSS 7.2) in Apple Cups, published November 20, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 81st percentile. Fixed in cups 1.5.3-2.7.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open