{"id":"CVE-2021-25317","aliases":["CLSA-2026-1785510391","CLSA-2026-1787145903","EUVD-2021-12215","GHSA-7qpc-9fjw-5c32","OESA-2021-1212","SUSE-SU-2021:1453-1","SUSE-SU-2021:1454-1","SUSE-SU-2021:14712-1","openSUSE-SU-2021:0638-1","openSUSE-SU-2024:10707-1"],"status":"published","title":"cups: ownership of /var/log/cups allows the lp user to create files as root","description":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0027,"percentile":0.19374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2021-04-30T07:17:38Z","modified":"2026-11-03T07:05:11Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-client","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-devel","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filesystem","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-ipptool","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-libs","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-lpd","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-printerapp","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"cups","fixed_in":["2.2.13-5.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cups","fixed_in":["1.7.5-20.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"cups","fixed_in":["2.2.7-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"cups","fixed_in":["1.3.9-8.46.56.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"cups","fixed_in":["1.3.9-8.46.56.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"cups","fixed_in":["2.2.7-lp152.9.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-52.el7_9.tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-5.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9-8.46.56.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9-8.46.56.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-lp152.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3op2-4.2"}]}],"bundled":20}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"factory"},{"vendor":"opensuse","product":"opensuse leap 15.2"},{"vendor":"suse","product":"cups"},{"vendor":"suse","product":"suse linux enterprise server 11-sp4-ltss"},{"vendor":"suse","product":"suse manager server 4.0"},{"vendor":"suse","product":"suse openstack cloud crowbar 9"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1184161","tags":["x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H74BP746O5NNVCBUTLLZYAFBPESFVECV/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S37IDQGHTORQ3Z6VRDQIGBYVOI27YG47/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWPGZLT3U776Q5YPPSA6LGFWWBDWBVH3/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25317","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWPGZLT3U776Q5YPPSA6LGFWWBDWBVH3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H74BP746O5NNVCBUTLLZYAFBPESFVECV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S37IDQGHTORQ3Z6VRDQIGBYVOI27YG47"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWPGZLT3U776Q5YPPSA6LGFWWBDWBVH3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H74BP746O5NNVCBUTLLZYAFBPESFVECV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S37IDQGHTORQ3Z6VRDQIGBYVOI27YG47"},{"url":"https://github.com/advisories/GHSA-7qpc-9fjw-5c32"},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1785510391.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58364","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787145903.html","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1212","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211453-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184161","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25317","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211454-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114712-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7GKB5OH3W4MLNXHW3ZQK7GEVLAEMXZ7C/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3898","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-25317","title":"cups: ownership of /var/log/cups allows the lp user to create files as root","description":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.","status":"published","published":"2021-05-05T09:35:13.321Z","modified":"2026-10-08T21:03:33.534Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-12215","description":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.","status":"published","published":"2021-05-05T09:35:13Z","modified":"2026-10-08T21:03:33Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-7qpc-9fjw-5c32","title":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise...","description":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.","status":"published","published":"2022-05-24T17:49:27Z","modified":"2026-10-08T21:33:41Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:12:58.478725Z"}],"nvd":[{"id":"CVE-2021-25317","description":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.","status":"published","published":"2021-05-05T10:15:08.133Z","modified":"2026-10-08T21:17:34.44Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-25317","description":"A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.","status":"published","published":"2021-05-05T10:15:08.133Z","modified":"2026-11-03T07:05:11.80235338Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:52:02.098855Z"},{"id":"OESA-2021-1212","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet PrintingProtocol (IPP) to support printing to local and network printers..\r\n\r\nSecurity Fix(es):\r\n\r\nA Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.(CVE-2021-25317)","status":"published","published":"2021-06-12T11:04:27Z","modified":"2026-08-18T01:15:47.061659436Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"CLSA-2026-1785510391","title":"cups: Fix of 2 CVEs","description":"- CVE-2021-25317: install /var/log/cups as 0700 root:sys instead of 0755 lp:sys\n  so the 'lp' user cannot plant symlinks that cupsd follows on log creation.\n  This matches the mode cupsd itself computes for the log directory\n  (0300|LogFilePerm with --with-log-file-perm=0600).\n- CVE-2025-58364: already addressed by Patch103 (upstream e58cba9d), shipped in\n  1:1.6.3-52.tuxcare.els5; no code change in this release.","status":"published","published":"2026-08-01T05:23:36Z","modified":"2026-10-26T09:31:42.898836356Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787145903","title":"cups: Fix of CVE-2021-25317","description":"- CVE-2021-25317: ship /var/log/cups owned by root:lp instead of lp:sys so a\n  local lp user can no longer plant a symlink in the log directory and make\n  the root cupsd create arbitrary root-owned files, matching current RHEL 9\n  packaging","status":"published","published":"2026-08-19T13:25:14Z","modified":"2026-10-26T09:30:32.325626618Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2021:0638-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2021-25317: ownership of /var/log/cups could allow privilege escalation from lp user to root via symlink attacks (bsc#1184161)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-04-30T19:23:03Z","modified":"2026-02-04T03:30:13.218377Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10707-1","title":"cups-2.3.3op2-4.2 on GA media","description":"These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:44.838396Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1453-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2021-25317: ownership of /var/log/cups could allow privilege escalation from lp user to root via symlink attacks (bsc#1184161)\n","status":"published","published":"2021-04-30T07:19:18Z","modified":"2026-02-04T04:00:18.658776Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1454-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2021-25317: ownership of /var/log/cups could allow privilege escalation from lp user to root via symlink attacks (bsc#1184161)\n","status":"published","published":"2021-04-30T07:23:22Z","modified":"2026-02-04T02:20:10.040776Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:14712-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2021-25317: ownership of /var/log/cups could allow privilege escalation from lp user to root via symlink attacks (bsc#1184161)\n","status":"published","published":"2021-04-30T07:17:38Z","modified":"2026-02-04T03:18:14.239027Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}