Every CVE Search/ Get API key

CVE-2015-1159

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the...

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Exploit likelihood

7.25%Up 3.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
CVE-2015-1159
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
CVE-2015-1159
Updated
2026-11-02
EUVDEUVD-2015-1302 No score

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
EUVD-2015-1302
Updated
2026-11-03
GitHub AdvisoriesGHSA-pmc2-2vx8-fmwf No score

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the...

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
GHSA-pmc2-2vx8-fmwf
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
CVE-2015-1159
Updated
2026-11-02
OSVDEBIAN-CVE-2015-1159 No score

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
DEBIAN-CVE-2015-1159
Updated
2026-11-02
Show 7 moreShow less
OSVMGASA-2015-0247 No score

Updated cups package fixes security vulnerabilities

It was discovered that CUPS incorrectly handled reference counting when handling localized strings. A remote attacker could use this issue to escalate permissions, upload a replacement CUPS configuration file, and execute arbitrary code (CVE-2015-1158).

It was discovered that the CUPS templating engine contained a cross-site scripting issue. A remote attacker could use this issue to bypass default configuration settings (CVE-2015-1159).

It was discovered that the CUPS server can get stuck in an infinite loop when a user queues a malformed gzip file. When this happens the CUPS server will be unable to service any further requests (STR#4602).

Record
MGASA-2015-0247
Updated
2026-11-02
OSVopenSUSE-SU-2024:10075-1 No score

cups-2.1.3-2.3 on GA media

These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10075-1
Updated
2026-11-02
OSVSUSE-SU-2015:1041-1 No score

Security update for cups

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1041-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-1 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-2 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-2
Updated
2026-11-02
OSVUBUNTU-CVE-2015-1159 No score

Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.

Record
UBUNTU-CVE-2015-1159
Updated
2026-11-02
OSVUSN-2629-1 No score

cups vulnerabilities

It was discovered that CUPS incorrectly handled reference counting when handling localized strings. A remote attacker could use this issue to escalate permissions, upload a replacement CUPS configuration file, and execute arbitrary code. (CVE-2015-1158)

It was discovered that the CUPS templating engine contained a cross-site scripting issue. A remote attacker could use this issue to bypass default configuration settings. (CVE-2015-1159)

Record
USN-2629-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
 before 1.7.5-12
1.7.5-12
cups
Debian:13
 before 1.7.5-12
1.7.5-12
cups
Debian:14
 before 1.7.5-12
1.7.5-12
cups
Debian:6.0
From an advisory covering 2 CVEs
 before 1.4.4-7+squeeze8, plus listed versions
1.4.4-71.4.4-7+squeeze11.4.4-7+squeeze21.4.4-7+squeeze31.4.4-7+squeeze41.4.4-7+squeeze51.4.4-7+squeeze61.4.4-7+squeeze7
1.4.4-7+squeeze8
cups
Debian:7
From an advisory covering 2 CVEs
 before 1.5.3-5+deb7u6, plus listed versions
1.5.3-51.5.3-5+deb7u11.5.3-5+deb7u21.5.3-5+deb7u31.5.3-5+deb7u41.5.3-5+deb7u5
1.5.3-5+deb7u6
cups
Debian:8
From an advisory covering 2 CVEs
 before 1.7.5-11+deb8u1, plus listed versions
1.7.5-11
1.7.5-11+deb8u1
cups
Mageia:4
From an advisory covering 2 CVEs
 before 1.7.0-7.5.mga4
1.7.0-7.5.mga4
cups
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
Show 61 moreShow less
Affected packages
PackageAffectedFixed
cups-lpd
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-lpd
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-lpd
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-lpd
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-client
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-filesystem
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-lpd
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-ipptool
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-client
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-filesystem
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-lpd
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-ipptool
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-client
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-filesystem
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-lpd
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-ipptool
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-client
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-filesystem
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-lpd
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-ipptool
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups
SUSE:Linux Enterprise Desktop 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups154
SUSE:Linux Enterprise Module for Legacy 12
From an advisory covering 3 CVEs
 before 1.5.4-9.1
1.5.4-9.1
cups
Ubuntu:14.04:LTS
 before 1.7.2-0ubuntu1.6, plus listed versions
1.7.0~rc1-0ubuntu51.7.0-0ubuntu21.7.0-0ubuntu31.7.0-11.7.0-2
Show 20 moreShow less
1.7.1-11.7.1-21.7.1-2git11.7.1-31.7.1-41.7.1-4ubuntu11.7.1-5ubuntu11.7.1-5ubuntu31.7.1-5ubuntu41.7.1-5ubuntu51.7.1-5ubuntu61.7.1-5ubuntu71.7.1-5ubuntu81.7.1-5ubuntu91.7.1-5ubuntu101.7.2-0ubuntu11.7.2-0ubuntu1.11.7.2-0ubuntu1.21.7.2-0ubuntu1.41.7.2-0ubuntu1.5
1.7.2-0ubuntu1.6
cups
Ubuntu:14.04:LTS
From an advisory covering 2 CVEs
 before 1.7.2-0ubuntu1.6, plus listed versions
1.7.0~rc1-0ubuntu51.7.0-0ubuntu21.7.0-0ubuntu31.7.0-11.7.0-2
Show 20 moreShow less
1.7.1-11.7.1-21.7.1-2git11.7.1-31.7.1-41.7.1-4ubuntu11.7.1-5ubuntu11.7.1-5ubuntu31.7.1-5ubuntu41.7.1-5ubuntu51.7.1-5ubuntu61.7.1-5ubuntu71.7.1-5ubuntu81.7.1-5ubuntu91.7.1-5ubuntu101.7.2-0ubuntu11.7.2-0ubuntu1.11.7.2-0ubuntu1.21.7.2-0ubuntu1.41.7.2-0ubuntu1.5
1.7.2-0ubuntu1.6
cups
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 2.1.3-2.3
2.1.3-2.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1159 is a medium vulnerability (CVSS 4.3) in Cups, published June 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.25%, the 94th percentile. Fixed in cups 1.7.5-12.

References

Show 55 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open