Every CVE Search/ Get API key

CVE-2014-4336

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before...

5.8 MediumFix available

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Exploit likelihood

1.06%Up 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.8

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
CVE-2014-4336
CVSS 2.0
5.8 MediumAV:A/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-77
Updated
2026-11-02
CVE List No score

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
CVE-2014-4336
Updated
2026-11-02
EUVDEUVD-2014-4263 No score

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
EUVD-2014-4263
Updated
2026-11-03
GitHub AdvisoriesGHSA-w4jh-3cpq-48pp No score

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before...

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
GHSA-w4jh-3cpq-48pp
Weakness
CWE-77
Updated
2026-11-02
OSV No score

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
CVE-2014-4336
Updated
2026-11-02
OSVDEBIAN-CVE-2014-4336 No score

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
DEBIAN-CVE-2014-4336
Updated
2026-11-02
OSVMGASA-2014-0267 No score

Updated cups-filter packages fix security vulnerabilities

In cups-filters before 1.0.53, out-of-bounds accesses in the process_browse_data function when reading the packet variable could leading to a crash, thus resulting in a denial of service (CVE-2014-4337).

In cups-filters before 1.0.53, if there was only a single BrowseAllow line in cups-browsed.conf and its host specification was invalid, this was interpreted as if no BrowseAllow line had been specified, which resulted in it accepting browse packets from all hosts (CVE-2014-4338).

The CVE-2014-2707 issue with malicious broadcast packets, which had been fixed in Mageia Bug 13216 (MGASA-2014-0181), had not been completely fixed by that update. A more complete fix was implemented in cups-filters 1.0.53 (CVE-2014-4336).

Note that only systems that have enabled the affected feature by using the CreateIPPPrinterQueues configuration directive in /etc/cups/cups-browsed.conf were affected by the CVE-2014-2707 / CVE-2014-4336 issue.

Record
MGASA-2014-0267
Updated
2026-11-02
OSVopenSUSE-SU-2024:10313-1 No score

cups-filters-1.8.2-1.11 on GA media

These are all security issues fixed in the cups-filters-1.8.2-1.11 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10313-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-4336 No score

The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

Record
UBUNTU-CVE-2014-4336
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups-filters
Debian:12
 before 1.0.53-1
1.0.53-1
cups-filters
Debian:13
 before 1.0.53-1
1.0.53-1
cups-filters
Debian:14
 before 1.0.53-1
1.0.53-1
cups-filters
Mageia:4
From an advisory covering 3 CVEs
 before 1.0.53-1.mga4
1.0.53-1.mga4
cups-filters
Ubuntu:14.04:LTS
 before 1.0.52-0ubuntu1.1, plus listed versions
1.0.40-0ubuntu11.0.40-0ubuntu21.0.41-0ubuntu11.0.41-21.0.42-1
Show 13 moreShow less
1.0.42-21.0.43-11.0.44-11.0.44-21.0.45-11.0.46-0ubuntu11.0.47-0ubuntu11.0.48-0ubuntu11.0.48-0ubuntu21.0.49-0ubuntu11.0.50-0ubuntu11.0.51-0ubuntu11.0.52-0ubuntu1
1.0.52-0ubuntu1.1
cups-filters
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 1.8.2-1.11
1.8.2-1.11

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-4336 is a medium vulnerability (CVSS 5.8) in Linuxfoundation Cups-filters, published June 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in cups-filters 1.0.53-1.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open