{"id":"CVE-2015-2265","aliases":["DEBIAN-CVE-2015-2265","EUVD-2015-2371","GHSA-4f5g-64px-29pq","MGASA-2015-0132","SUSE-SU-2015:0805-1","UBUNTU-CVE-2015-2265","USN-2532-1","openSUSE-SU-2024:10313-1"],"status":"published","title":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote...","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02958,"percentile":0.87286,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2015-03-12T00:00:00Z","modified":"2026-09-09T06:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"cups-filters","fixed_in":["1.0.61-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups-filters","fixed_in":["1.0.61-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups-filters","fixed_in":["1.0.61-5"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"cups-filters","fixed_in":["1.0.53-1.1.mga4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"cups-filters","fixed_in":["1.0.58-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"cups-filters","fixed_in":["1.0.58-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"cups-filters","fixed_in":["1.0.58-5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"cups-filters","fixed_in":["1.0.52-0ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.61-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.61-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.61-5"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.53-1.1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.52-0ubuntu1.4"}]}],"versions":["1.0.40-0ubuntu1","1.0.40-0ubuntu2","1.0.41-0ubuntu1","1.0.41-2","1.0.42-1","1.0.42-2","1.0.43-1","1.0.44-1","1.0.44-2","1.0.45-1","1.0.46-0ubuntu1","1.0.47-0ubuntu1","1.0.48-0ubuntu1","1.0.48-0ubuntu2","1.0.49-0ubuntu1","1.0.50-0ubuntu1","1.0.51-0ubuntu1","1.0.52-0ubuntu1","1.0.52-0ubuntu1.1","1.0.52-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.52-0ubuntu1.4"}]}],"versions":["1.0.40-0ubuntu1","1.0.40-0ubuntu2","1.0.41-0ubuntu1","1.0.41-2","1.0.42-1","1.0.42-2","1.0.43-1","1.0.44-1","1.0.44-2","1.0.45-1","1.0.46-0ubuntu1","1.0.47-0ubuntu1","1.0.48-0ubuntu1","1.0.48-0ubuntu2","1.0.49-0ubuntu1","1.0.50-0ubuntu1","1.0.51-0ubuntu1","1.0.52-0ubuntu1","1.0.52-0ubuntu1.1","1.0.52-0ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1.11"}]}],"bundled":13}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"linuxfoundation","product":"cups-filters"}],"references":[{"url":"https://bugs.linuxfoundation.org/show_bug.cgi?id=1265","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence","report"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:196","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7333","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2532-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","fix"]},{"url":"http://advisories.mageia.org/MGASA-2015-0132.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00033.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2265"},{"url":"https://github.com/advisories/GHSA-4f5g-64px-29pq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-2265","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0132.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15424","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2532-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150805-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/915545","tags":["report"]},{"url":"https://bugzilla.suse.com/921753","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2265","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-2265","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/09/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2532-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2265","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8560","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-2265","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2015-03-24T17:00:00Z","modified":"2024-08-06T05:10:15.383Z","updated_at":"2026-11-02T14:35:41.621934Z"}],"euvd":[{"id":"EUVD-2015-2371","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2015-03-24T17:00:00Z","modified":"2024-08-06T05:10:15Z","updated_at":"2026-11-03T02:22:12.40366Z"}],"ghsa":[{"id":"GHSA-4f5g-64px-29pq","title":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote...","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2022-05-17T03:14:53Z","modified":"2023-01-27T05:07:00Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:43:01.786793Z"}],"nvd":[{"id":"CVE-2015-2265","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2015-03-24T17:59:09.727Z","modified":"2026-06-17T00:23:50.047Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CVE-2015-2265","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2015-03-24T17:59:09Z","modified":"2026-04-16T06:18:06.088943279Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-2265","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2015-03-24T17:59:09.727Z","modified":"2026-09-09T06:47:30.533395821Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0132","title":"Updated cups-filters packages fix CVE-2015-2265","description":"Updated cups-filters package fixes security vulnerability:\n\ncups-browsed in cups-filters before 1.0.66 contained a bug in the\nremove_bad_chars() function, where it failed to reliably filter out illegal\ncharacters if there were two or more subsequent illegal characters, allowing\nexecution of arbitrary commands with the rights of the \"lp\" user, using forged\nprint service announcements on DNS-SD servers (CVE-2015-2265).\n","status":"published","published":"2015-04-04T10:45:56Z","modified":"2026-04-16T06:23:09.276110826Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10313-1","title":"cups-filters-1.8.2-1.11 on GA media","description":"These are all security issues fixed in the cups-filters-1.8.2-1.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:18.374482Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0805-1","title":"Security update for cups-filters","description":"cups-filters was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2015-2265: Remote command execution in remove_bad_chars() (bnc#921753).\n\nThis non-security issue was fixed:\n- LSB compliance of foomatic-rip (bnc#915545).\n  ","status":"published","published":"2015-03-13T12:25:45Z","modified":"2026-02-04T02:57:40.549777Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-2265","description":"The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.","status":"published","published":"2015-03-12T00:00:00Z","modified":"2026-04-22T10:04:23.294925Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2532-1","title":"cups-filters vulnerability","description":"It was discovered that cups-browsed incorrectly filtered remote printer\nnames and strings. A remote attacker could use this issue to possibly\nexecute arbitrary commands.\n","status":"published","published":"2015-03-16T14:17:25Z","modified":"2026-04-22T09:09:19.719921Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}