CVE-2014-8166 Information

Description

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names which might allow remote attackers to execute arbitrary code via a crafted printer name.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

http://www.openwall.com/lists/oss-security/2015/03/24/15 http://www.openwall.com/lists/oss-security/2015/03/24/2 http://www.securityfocus.com/bid/73300 https://bugzilla.redhat.com/show_bug.cgi?id=1084577

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8