{"id":"CVE-2014-5030","aliases":["DEBIAN-CVE-2014-5030","DLA-0022-1","DSA-2990-1","EUVD-2014-4929","GHSA-f4q9-g8vj-q74x","MGASA-2014-0313","RHBA-2015:0386","RHSA-2014:1388","SUSE-SU-2015:0575-1","SUSE-SU-2015:1011-1","UBUNTU-CVE-2014-5030","USN-2341-1","openSUSE-SU-2024:10075-1"],"status":"published","title":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html...","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","severity":{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00362,"percentile":0.3019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2014-07-27T00:00:00Z","modified":"2026-10-23T15:47:27Z","fixes":[{"ecosystem":"Debian:12","package":"cups","fixed_in":["1.7.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups","fixed_in":["1.7.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["1.7.4-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"cups","fixed_in":["1.7.2-0ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-7+squeeze6"}]}],"versions":["1.4.4-7","1.4.4-7+squeeze1","1.4.4-7+squeeze2","1.4.4-7+squeeze3","1.4.4-7+squeeze4","1.4.4-7+squeeze5"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5+deb7u4"}]}],"versions":["1.5.3-5","1.5.3-5+deb7u1","1.5.3-5+deb7u2","1.5.3-5+deb7u3"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-9.4.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-7.3.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-17.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"cups-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"cups-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"cups-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"cups-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.2-67.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-0ubuntu1.2"}]}],"versions":["1.7.0~rc1-0ubuntu5","1.7.0-0ubuntu2","1.7.0-0ubuntu3","1.7.0-1","1.7.0-2","1.7.1-1","1.7.1-2","1.7.1-2git1","1.7.1-3","1.7.1-4","1.7.1-4ubuntu1","1.7.1-5ubuntu1","1.7.1-5ubuntu3","1.7.1-5ubuntu4","1.7.1-5ubuntu5","1.7.1-5ubuntu6","1.7.1-5ubuntu7","1.7.1-5ubuntu8","1.7.1-5ubuntu9","1.7.1-5ubuntu10","1.7.2-0ubuntu1","1.7.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-0ubuntu1.2"}]}],"versions":["1.7.0~rc1-0ubuntu5","1.7.0-0ubuntu2","1.7.0-0ubuntu3","1.7.0-1","1.7.0-2","1.7.1-1","1.7.1-2","1.7.1-2git1","1.7.1-3","1.7.1-4","1.7.1-4ubuntu1","1.7.1-5ubuntu1","1.7.1-5ubuntu3","1.7.1-5ubuntu4","1.7.1-5ubuntu5","1.7.1-5ubuntu6","1.7.1-5ubuntu7","1.7.1-5ubuntu8","1.7.1-5ubuntu9","1.7.1-5ubuntu10","1.7.2-0ubuntu1","1.7.2-0ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-2.3"}]}],"bundled":17}],"products":[{"vendor":"apple","product":"cups"},{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"https://cups.org/str.php?L4455","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.ubuntu.com/usn/USN-2341-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/07/22/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1388.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/60787","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2990","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/07/22/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0313.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/60509","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:108","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5030","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f4q9-g8vj-q74x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5030","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0313.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13783","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135528.html","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2990","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2015:0386","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1087323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1113045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1149245","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1153708","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhba-2015_0386.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-2856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1087122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2856","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1115576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3537","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-5029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122600","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-5030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5030","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-5031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5031","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5031","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1388","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/cups.html#RHSA-2014-1388","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=978387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1012482","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1388.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150575-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/789566","tags":["report"]},{"url":"https://bugzilla.suse.com/827109","tags":["report"]},{"url":"https://bugzilla.suse.com/887240","tags":["report"]},{"url":"https://bugzilla.suse.com/917799","tags":["report"]},{"url":"https://bugzilla.suse.com/924208","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151011-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-5030","tags":["report"]},{"url":"http://seclists.org/oss-sec/2014/q3/209","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2341-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-5029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5031","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1159","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5030","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2014-07-29T14:00:00Z","modified":"2024-08-06T11:34:37.133Z","updated_at":"2026-11-02T14:33:41.553118Z"}],"euvd":[{"id":"EUVD-2014-4929","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2014-07-29T14:00:00Z","modified":"2024-08-06T11:34:37Z","updated_at":"2026-11-03T01:57:04.299217Z"}],"ghsa":[{"id":"GHSA-f4q9-g8vj-q74x","title":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html...","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2022-05-17T03:05:52Z","modified":"2023-01-27T05:06:36Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:42:57.198879Z"}],"nvd":[{"id":"CVE-2014-5030","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2014-07-29T14:55:07.827Z","modified":"2026-06-17T00:10:57.247Z","cvss":[{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"CVE-2014-5030","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2014-07-29T14:55:07Z","modified":"2026-04-16T06:15:45.438006656Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5030","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2014-07-29T14:55:07.827Z","modified":"2026-10-23T15:47:27.698241773Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-0022-1","title":"cups - security update","status":"published","published":"2014-07-31T00:00:00Z","modified":"2026-03-09T01:01:40.711918Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-2990-1","title":"cups - security update","status":"published","published":"2014-07-27T00:00:00Z","modified":"2026-03-09T01:22:56.88682Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0313","title":"Updated cups packages fix security vulnerability","description":"In CUPS before 1.7.4, a local user with privileges of group=lp can write\nsymbolic links in the rss directory and use that to gain '@SYSTEM' group\nprivilege with cupsd (CVE-2014-3537).\n\nIt was discovered that the web interface in CUPS incorrectly validated\npermissions on rss files and directory index files. A local attacker could\npossibly use this issue to bypass file permissions and read arbitrary files,\npossibly leading to a privilege escalation (CVE-2014-5029, CVE-2014-5030,\nCVE-2014-5031).\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:23:03.775324569Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10075-1","title":"cups-2.1.3-2.3 on GA media","description":"These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:46.163647Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHBA-2015:0386","title":"Red Hat Bug Fix Advisory: cups bug fix and enhancement update","status":"published","published":"2024-09-15T21:48:50Z","modified":"2026-06-26T12:21:47.576320907Z","updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2014:1388","title":"Red Hat Security Advisory: cups security and bug fix update","status":"published","published":"2024-09-15T21:48:55Z","modified":"2026-06-26T12:20:56.372994833Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0575-1","title":"Security update for CUPS","description":"\nThis update fixes various issues in CUPS.\n\n    * CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various\n      insufficient symbolic link checking could have lead to privilege\n      escalation from the lp user to root.\n\nSecurity Issues:\n\n    * CVE-2014-3537\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537\u003e\n    * CVE-2014-5029\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029\u003e\n    * CVE-2014-5030\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030\u003e\n    * CVE-2014-5031\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031\u003e\n\n","status":"published","published":"2014-07-29T16:37:43Z","modified":"2026-02-04T04:08:26.71144Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1011-1","title":"Security update for CUPS","description":"\nThis update fixes various issues in CUPS.\n\n    * CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various\n      insufficient symbolic link checking could have lead to privilege\n      escalation from the lp user to root.\n\nSecurity Issues:\n\n    * CVE-2014-3537\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537\u003e\n    * CVE-2014-5029\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029\u003e\n    * CVE-2014-5030\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030\u003e\n    * CVE-2014-5031\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031\u003e\n\n","status":"published","published":"2014-07-29T16:37:43Z","modified":"2026-02-04T02:47:00.223443Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-5030","description":"CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.","status":"published","published":"2014-07-29T00:00:00Z","modified":"2026-04-22T09:45:20.120112Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2341-1","title":"cups vulnerabilities","description":"Salvatore Bonaccorso discovered that the CUPS web interface incorrectly\nvalidated permissions and incorrectly handled symlinks. An attacker could\npossibly use this issue to bypass file permissions and read arbitrary\nfiles, possibly leading to a privilege escalation.\n","status":"published","published":"2014-09-08T14:17:56Z","modified":"2026-04-22T08:59:40.187474Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}