Every CVE Search/ Get API key

CVE-2012-5519

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web...

7.2 HighPublic exploitFix available

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Exploit likelihood

2.13%Down 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
CVE-2012-5519
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
CVE-2012-5519
Updated
2026-11-02
EUVDEUVD-2012-5411 No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
EUVD-2012-5411
Updated
2026-11-03
GitHub AdvisoriesGHSA-ccjj-h3mm-j4rr No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web...

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
GHSA-ccjj-h3mm-j4rr
Updated
2026-11-02
OSV No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
CVE-2012-5519
Updated
2026-11-02
OSVDEBIAN-CVE-2012-5519 No score

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

Record
DEBIAN-CVE-2012-5519
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:10075-1 No score

cups-2.1.3-2.3 on GA media

These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10075-1
Updated
2026-11-02
OSVSUSE-SU-2015:0575-1 No score

Security update for CUPS

This update fixes various issues in CUPS.

* CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various
  insufficient symbolic link checking could have lead to privilege
  escalation from the lp user to root.

Security Issues:

* CVE-2014-3537
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537>
* CVE-2014-5029
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029>
* CVE-2014-5030
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030>
* CVE-2014-5031
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031>
Record
SUSE-SU-2015:0575-1
Updated
2026-11-02
OSVSUSE-SU-2015:1011-1 No score

Security update for CUPS

This update fixes various issues in CUPS.

* CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various
  insufficient symbolic link checking could have lead to privilege
  escalation from the lp user to root.

Security Issues:

* CVE-2014-3537
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537>
* CVE-2014-5029
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029>
* CVE-2014-5030
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030>
* CVE-2014-5031
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031>
Record
SUSE-SU-2015:1011-1
Updated
2026-11-02
OSVSUSE-SU-2015:1041-1 No score

Security update for cups

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1041-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-1 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-2 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
 before 1.5.3-2.7
1.5.3-2.7
cups
Debian:13
 before 1.5.3-2.7
1.5.3-2.7
cups
Debian:14
 before 1.5.3-2.7
1.5.3-2.7
cups
Debian:6.0
 before 1.4.4-7+squeeze2, plus listed versions
1.4.4-71.4.4-7+squeeze1
1.4.4-7+squeeze2
cups
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-debuginfo
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-devel
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-libs
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups-lpd
Red Hat:enterprise_linux:5::server
 before 1:1.3.7-30.el5_9.3
1:1.3.7-30.el5_9.3
cups
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
Show 29 moreShow less
Affected packages
PackageAffectedFixed
cups-debuginfo
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::client
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::computenode
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-debuginfo
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::server
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-devel
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-libs
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-lpd
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups-php
Red Hat:enterprise_linux:6::workstation
 before 1:1.4.2-50.el6_4.4
1:1.4.2-50.el6_4.4
cups
SUSE:Linux Enterprise Desktop 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups154
SUSE:Linux Enterprise Module for Legacy 12
From an advisory covering 3 CVEs
 before 1.5.4-9.1
1.5.4-9.1
cups
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 2.1.3-2.3
2.1.3-2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubp1ckzi/CVE-2012-55192022-01-07
MetasploitCUPS 1.6.1 Root File Read2012-11-20

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5519 is a high vulnerability (CVSS 7.2) in Apple Cups, published November 20, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in cups 1.5.3-2.7.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open