Every CVE Search/ Get API key

CVE-2015-1158

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free...

10.0 HighPublic exploitFix available

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Exploit likelihood

29.7%Up 11.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
CVE-2015-1158
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-254
Updated
2026-11-02
CVE List No score

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
CVE-2015-1158
Updated
2026-11-02
EUVDEUVD-2015-1301 No score

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
EUVD-2015-1301
Updated
2026-11-03
GitHub AdvisoriesGHSA-f3f2-vc32-jrrx No score

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free...

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
GHSA-f3f2-vc32-jrrx
Updated
2026-11-02
OSV No score

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
CVE-2015-1158
Updated
2026-11-02
OSVDEBIAN-CVE-2015-1158 No score

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
DEBIAN-CVE-2015-1158
Updated
2026-11-02
Show 7 moreShow less
OSVMGASA-2015-0247 No score

Updated cups package fixes security vulnerabilities

It was discovered that CUPS incorrectly handled reference counting when handling localized strings. A remote attacker could use this issue to escalate permissions, upload a replacement CUPS configuration file, and execute arbitrary code (CVE-2015-1158).

It was discovered that the CUPS templating engine contained a cross-site scripting issue. A remote attacker could use this issue to bypass default configuration settings (CVE-2015-1159).

It was discovered that the CUPS server can get stuck in an infinite loop when a user queues a malformed gzip file. When this happens the CUPS server will be unable to service any further requests (STR#4602).

Record
MGASA-2015-0247
Updated
2026-11-02
OSVopenSUSE-SU-2024:10075-1 No score

cups-2.1.3-2.3 on GA media

These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10075-1
Updated
2026-11-02
OSVSUSE-SU-2015:1041-1 No score

Security update for cups

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1041-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-1 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-1
Updated
2026-11-02
OSVSUSE-SU-2015:1044-2 No score

Security update for cups154

The following issues are fixed by this update:

  • CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208).
  • CVE-2015-1158: Improper Update of Reference Count
  • CVE-2015-1159: Cross-Site Scripting
Record
SUSE-SU-2015:1044-2
Updated
2026-11-02
OSVUBUNTU-CVE-2015-1158 No score

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Record
UBUNTU-CVE-2015-1158
Updated
2026-11-02
OSVUSN-2629-1 No score

cups vulnerabilities

It was discovered that CUPS incorrectly handled reference counting when handling localized strings. A remote attacker could use this issue to escalate permissions, upload a replacement CUPS configuration file, and execute arbitrary code. (CVE-2015-1158)

It was discovered that the CUPS templating engine contained a cross-site scripting issue. A remote attacker could use this issue to bypass default configuration settings. (CVE-2015-1159)

Record
USN-2629-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
 before 1.7.5-12
1.7.5-12
cups
Debian:13
 before 1.7.5-12
1.7.5-12
cups
Debian:14
 before 1.7.5-12
1.7.5-12
cups
Debian:6.0
From an advisory covering 2 CVEs
 before 1.4.4-7+squeeze8, plus listed versions
1.4.4-71.4.4-7+squeeze11.4.4-7+squeeze21.4.4-7+squeeze31.4.4-7+squeeze41.4.4-7+squeeze51.4.4-7+squeeze61.4.4-7+squeeze7
1.4.4-7+squeeze8
cups
Debian:7
From an advisory covering 2 CVEs
 before 1.5.3-5+deb7u6, plus listed versions
1.5.3-51.5.3-5+deb7u11.5.3-5+deb7u21.5.3-5+deb7u31.5.3-5+deb7u41.5.3-5+deb7u5
1.5.3-5+deb7u6
cups
Debian:8
From an advisory covering 2 CVEs
 before 1.7.5-11+deb8u1, plus listed versions
1.7.5-11
1.7.5-11+deb8u1
cups
Mageia:4
From an advisory covering 2 CVEs
 before 1.7.0-7.5.mga4
1.7.0-7.5.mga4
cups
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
Show 61 moreShow less
Affected packages
PackageAffectedFixed
cups-lpd
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-lpd
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-lpd
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-lpd
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups-php
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:1.4.2-67.el6_6.1
1:1.4.2-67.el6_6.1
cups
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-client
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-filesystem
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-lpd
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-ipptool
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-client
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-filesystem
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-lpd
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-ipptool
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-client
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-filesystem
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-lpd
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups-ipptool
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 1:1.6.3-17.ael7b_1.1
1:1.6.3-17.ael7b_1.1
cups
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-client
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-filesystem
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-lpd
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups-ipptool
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 1:1.6.3-17.el7_1.1
1:1.6.3-17.el7_1.1
cups
SUSE:Linux Enterprise Desktop 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 3 CVEs
 before 1.7.5-9.1
1.7.5-9.1
cups154
SUSE:Linux Enterprise Module for Legacy 12
From an advisory covering 3 CVEs
 before 1.5.4-9.1
1.5.4-9.1
cups
Ubuntu:14.04:LTS
 before 1.7.2-0ubuntu1.6, plus listed versions
1.7.0~rc1-0ubuntu51.7.0-0ubuntu21.7.0-0ubuntu31.7.0-11.7.0-2
Show 20 moreShow less
1.7.1-11.7.1-21.7.1-2git11.7.1-31.7.1-41.7.1-4ubuntu11.7.1-5ubuntu11.7.1-5ubuntu31.7.1-5ubuntu41.7.1-5ubuntu51.7.1-5ubuntu61.7.1-5ubuntu71.7.1-5ubuntu81.7.1-5ubuntu91.7.1-5ubuntu101.7.2-0ubuntu11.7.2-0ubuntu1.11.7.2-0ubuntu1.21.7.2-0ubuntu1.41.7.2-0ubuntu1.5
1.7.2-0ubuntu1.6
cups
Ubuntu:14.04:LTS
From an advisory covering 2 CVEs
 before 1.7.2-0ubuntu1.6, plus listed versions
1.7.0~rc1-0ubuntu51.7.0-0ubuntu21.7.0-0ubuntu31.7.0-11.7.0-2
Show 20 moreShow less
1.7.1-11.7.1-21.7.1-2git11.7.1-31.7.1-41.7.1-4ubuntu11.7.1-5ubuntu11.7.1-5ubuntu31.7.1-5ubuntu41.7.1-5ubuntu51.7.1-5ubuntu61.7.1-5ubuntu71.7.1-5ubuntu81.7.1-5ubuntu91.7.1-5ubuntu101.7.2-0ubuntu11.7.2-0ubuntu1.11.7.2-0ubuntu1.21.7.2-0ubuntu1.41.7.2-0ubuntu1.5
1.7.2-0ubuntu1.6
cups
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 2.1.3-2.3
2.1.3-2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBCUPS < 2.0.3 - Multiple Vulnerabilities2015-06-22
Exploit-DBCUPS < 2.0.3 - Remote Command Execution2017-02-03

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1158 is a high vulnerability (CVSS 10.0) in Cups, published June 9, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 29.7%, the 98th percentile. Fixed in cups 1.7.5-12.

References

Show 58 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open