CVE-2015-2265
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote...
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
Exploit likelihood
What each source reports
NVD Score used
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
CVE-2015-2265- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
CVE-2015-2265- Updated
- 2026-11-02
EUVDEUVD-2015-2371 No score
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
EUVD-2015-2371- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4f5g-64px-29pq No score
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote...
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
GHSA-4f5g-64px-29pq- Weakness
- CWE-77
- Updated
- 2026-11-02
OSV No score
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
CVE-2015-2265- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2265 No score
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
DEBIAN-CVE-2015-2265- Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2015-0132 No score
Updated cups-filters packages fix CVE-2015-2265
Updated cups-filters package fixes security vulnerability:
cups-browsed in cups-filters before 1.0.66 contained a bug in the remove_bad_chars() function, where it failed to reliably filter out illegal characters if there were two or more subsequent illegal characters, allowing execution of arbitrary commands with the rights of the "lp" user, using forged print service announcements on DNS-SD servers (CVE-2015-2265).
- Record
MGASA-2015-0132- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10313-1 No score
cups-filters-1.8.2-1.11 on GA media
These are all security issues fixed in the cups-filters-1.8.2-1.11 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10313-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0805-1 No score
Security update for cups-filters
cups-filters was updated to fix one security issue.
This security issue was fixed:
- CVE-2015-2265: Remote command execution in remove_bad_chars() (bnc#921753).
This non-security issue was fixed:
- LSB compliance of foomatic-rip (bnc#915545).
- Record
SUSE-SU-2015:0805-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2265 No score
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
- Record
UBUNTU-CVE-2015-2265- Updated
- 2026-11-02
OSVUSN-2532-1 No score
cups-filters vulnerability
It was discovered that cups-browsed incorrectly filtered remote printer names and strings. A remote attacker could use this issue to possibly execute arbitrary commands.
- Record
USN-2532-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cups-filtersDebian:12 |
before 1.0.61-5 | 1.0.61-5 |
cups-filtersDebian:13 |
before 1.0.61-5 | 1.0.61-5 |
cups-filtersDebian:14 |
before 1.0.61-5 | 1.0.61-5 |
cups-filtersMageia:4 |
before 1.0.53-1.1.mga4 | 1.0.53-1.1.mga4 |
cups-filtersSUSE:Linux Enterprise Desktop 12 |
before 1.0.58-5.1 | 1.0.58-5.1 |
cups-filtersSUSE:Linux Enterprise Server 12 |
before 1.0.58-5.1 | 1.0.58-5.1 |
cups-filtersSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.0.58-5.1 | 1.0.58-5.1 |
cups-filtersUbuntu:14.04:LTS |
before 1.0.52-0ubuntu1.4, plus listed versions 1.0.40-0ubuntu11.0.40-0ubuntu21.0.41-0ubuntu11.0.41-21.0.42-1 Show 15 moreShow less1.0.42-21.0.43-11.0.44-11.0.44-21.0.45-11.0.46-0ubuntu11.0.47-0ubuntu11.0.48-0ubuntu11.0.48-0ubuntu21.0.49-0ubuntu11.0.50-0ubuntu11.0.51-0ubuntu11.0.52-0ubuntu11.0.52-0ubuntu1.11.0.52-0ubuntu1.2 |
1.0.52-0ubuntu1.4 |
cups-filtersopenSUSE:Tumbleweed |
before 1.8.2-1.11 | 1.8.2-1.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2265 is a high vulnerability (CVSS 7.5) in Linuxfoundation Cups-filters, published March 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.96%, the 87th percentile. Fixed in cups-filters 1.0.61-5.
References
bugs.linuxfoundation.org/show_bug.cgi?id=1265
mandriva.com/security/advisories?name=MDVSA-2015:196
bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7333
ubuntu.com/usn/USN-2532-1
advisories.mageia.org/MGASA-2015-0132.html
lists.opensuse.org/opensuse-updates/2015-07/msg00033.html
Show 25 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-2265
github.com/advisories/GHSA-4f5g-64px-29pq
security-tracker.debian.org/tracker/CVE-2015-2265
bugs.mageia.org/show_bug.cgi?id=15424
suse.com/support/update/announcement/2015/suse-su-20150805-1
bugzilla.suse.com/915545
ubuntu.com/security/CVE-2015-2265
openwall.com/lists/oss-security/2015/03/09/5
cve.org/CVERecord?id=CVE-2015-2265