1.2 - CVE-2014-3537

Executive Summary

Informations
Name	CVE-2014-3537	First vendor Publication	2014-07-23
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:H/Au:N/C:P/I:N/A:N)
Cvss Base Score	1.2	Attack Range	Local
Cvss Impact Score	2.9	Attack Complexity	High
Cvss Expoit Score	1.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-59	Improper Link Resolution Before File Access ('Link Following')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:26078

Oval ID:	oval:org.mitre.oval:def:26078
Title:	USN-2293-1 -- cups vulnerability
Description:	CUPS could be made to expose sensitive information, leading to privilege escalation.
Family:	unix	Class:	patch
Reference(s):	USN-2293-1 CVE-2014-3537	Version:	3
Platform(s):	Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04	Product(s):	cups
Definition Synopsis:
Ubuntu 14.04 release section Ubuntu 14.04 is installed AND cups DPKG is earlier than 0:1.7.2-0ubuntu1.1 AND Ubuntu 12.04 release section Ubuntu 12.04 is installed AND cups DPKG is earlier than 0:1.5.3-0ubuntu8.4 AND Ubuntu 10.04 release section Ubuntu 10.04 is installed AND cups DPKG is earlier than 0:1.4.3-1ubuntu1.12

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apple Cups cpe:2.3:a:apple:cups:1.7.3:::::::* cpe:2.3:a:apple:cups:1.7.2:::::::* cpe:2.3:a:apple:cups:1.7.1:b1:::::: cpe:2.3:a:apple:cups:1.7.1:::::::* cpe:2.3:a:apple:cups:1.7.0:::::::* cpe:2.3:a:apple:cups:1.7:rc1:::::: cpe:2.3:a:apple:cups:1.6.4:::::::* cpe:2.3:a:apple:cups:1.6.3:::::::* cpe:2.3:a:apple:cups:1.6.2:::::::* cpe:2.3:a:apple:cups:1.6.1:::::::* cpe:2.3:a:apple:cups:1.6:b1:::::: cpe:2.3:a:apple:cups:1.6:rc1:::::: cpe:2.3:a:apple:cups:1.5.4:::::::* cpe:2.3:a:apple:cups:1.5.3:::::::* cpe:2.3:a:apple:cups:1.5.2:::::::* cpe:2.3:a:apple:cups:1.5.1:::::::* cpe:2.3:a:apple:cups:1.5.0:::::::* cpe:2.3:a:apple:cups:1.5:b1:::::: cpe:2.3:a:apple:cups:1.5:b2:::::: cpe:2.3:a:apple:cups:1.5:rc1:::::: cpe:2.3:a:apple:cups:1.4.8:::::::* cpe:2.3:a:apple:cups:1.4.7:::::::* cpe:2.3:a:apple:cups:1.4.6:::::::* cpe:2.3:a:apple:cups:1.4.5:::::::* cpe:2.3:a:apple:cups:1.4.4:::::::* cpe:2.3:a:apple:cups:1.4.3:::::::* cpe:2.3:a:apple:cups:1.4.2:::::::* cpe:2.3:a:apple:cups:1.4.1:::::::* cpe:2.3:a:apple:cups:1.4.0:::::::* cpe:2.3:a:apple:cups:1.4:b1:::::: cpe:2.3:a:apple:cups:1.4:b2:::::: cpe:2.3:a:apple:cups:1.4:rc1:::::: cpe:2.3:a:apple:cups:1.4:b3:::::: cpe:2.3:a:apple:cups:1.3.9:::::::* cpe:2.3:a:apple:cups:1.3.8:::::::* cpe:2.3:a:apple:cups:1.3.7:::::::* cpe:2.3:a:apple:cups:1.3.6:::::::* cpe:2.3:a:apple:cups:1.3.5:::::::* cpe:2.3:a:apple:cups:1.3.4:::::::* cpe:2.3:a:apple:cups:1.3.3:::::::* cpe:2.3:a:apple:cups:1.3.2:::::::* cpe:2.3:a:apple:cups:1.3.11:::::::* cpe:2.3:a:apple:cups:1.3.10:::::::* cpe:2.3:a:apple:cups:1.3.1:::::::* cpe:2.3:a:apple:cups:1.3.0:::::::* cpe:2.3:a:apple:cups:1.3:rc1:::::: cpe:2.3:a:apple:cups:1.3:b1:::::: cpe:2.3:a:apple:cups:1.3:rc2:::::: cpe:2.3:a:apple:cups:1.2.9:::::::* cpe:2.3:a:apple:cups:1.2.8:::::::* cpe:2.3:a:apple:cups:1.2.7:::::::* cpe:2.3:a:apple:cups:1.2.6:::::::* cpe:2.3:a:apple:cups:1.2.5:::::::* cpe:2.3:a:apple:cups:1.2.4:::::::* cpe:2.3:a:apple:cups:1.2.3:::::::* cpe:2.3:a:apple:cups:1.2.2:::::::* cpe:2.3:a:apple:cups:1.2.12:::::::* cpe:2.3:a:apple:cups:1.2.11:::::::* cpe:2.3:a:apple:cups:1.2.10:::::::* cpe:2.3:a:apple:cups:1.2.1:::::::* cpe:2.3:a:apple:cups:1.2.0:::::::* cpe:2.3:a:apple:cups:1.2:b1:::::: cpe:2.3:a:apple:cups:1.2:b2:::::: cpe:2.3:a:apple:cups:1.2:rc3:::::: cpe:2.3:a:apple:cups:1.2:rc2:::::: cpe:2.3:a:apple:cups:1.2:rc1:::::: cpe:2.3:a:apple:cups:1.1.9-1:::::::* cpe:2.3:a:apple:cups:1.1.9:::::::* cpe:2.3:a:apple:cups:1.1.8:::::::* cpe:2.3:a:apple:cups:1.1.7:::::::* cpe:2.3:a:apple:cups:1.1.6-3:::::::* cpe:2.3:a:apple:cups:1.1.6-2:::::::* cpe:2.3:a:apple:cups:1.1.6-1:::::::* cpe:2.3:a:apple:cups:1.1.6:::::::* cpe:2.3:a:apple:cups:1.1.5-2:::::::* cpe:2.3:a:apple:cups:1.1.5-1:::::::* cpe:2.3:a:apple:cups:1.1.5:::::::* cpe:2.3:a:apple:cups:1.1.4:::::::* cpe:2.3:a:apple:cups:1.1.3:::::::* cpe:2.3:a:apple:cups:1.1.23:rc1:::::: cpe:2.3:a:apple:cups:1.1.23:::::::* cpe:2.3:a:apple:cups:1.1.22:::::::* cpe:2.3:a:apple:cups:1.1.22:rc1:::::: cpe:2.3:a:apple:cups:1.1.22:rc2:::::: cpe:2.3:a:apple:cups:1.1.21:rc2:::::: cpe:2.3:a:apple:cups:1.1.21:rc1:::::: cpe:2.3:a:apple:cups:1.1.21:::::::* cpe:2.3:a:apple:cups:1.1.21:-:::::: cpe:2.3:a:apple:cups:1.1.20:rc3:::::: cpe:2.3:a:apple:cups:1.1.20:::::::* cpe:2.3:a:apple:cups:1.1.20:rc5:::::: cpe:2.3:a:apple:cups:1.1.20:rc4:::::: cpe:2.3:a:apple:cups:1.1.20:rc2:::::: cpe:2.3:a:apple:cups:1.1.20:rc1:::::: cpe:2.3:a:apple:cups:1.1.20:rc6:::::: cpe:2.3:a:apple:cups:1.1.2:::::::* cpe:2.3:a:apple:cups:1.1.19:rc1:::::: cpe:2.3:a:apple:cups:1.1.19:rc3:::::: cpe:2.3:a:apple:cups:1.1.19:rc2:::::: cpe:2.3:a:apple:cups:1.1.19:rc5:::::: cpe:2.3:a:apple:cups:1.1.19:rc4:::::: cpe:2.3:a:apple:cups:1.1.19:::::::* cpe:2.3:a:apple:cups:1.1.18:::::::* cpe:2.3:a:apple:cups:1.1.17:::::::* cpe:2.3:a:apple:cups:1.1.16:::::::* cpe:2.3:a:apple:cups:1.1.15:::::::* cpe:2.3:a:apple:cups:1.1.14:::::::* cpe:2.3:a:apple:cups:1.1.13:::::::* cpe:2.3:a:apple:cups:1.1.12:::::::* cpe:2.3:a:apple:cups:1.1.11:::::::* cpe:2.3:a:apple:cups:1.1.10-1:::::::* cpe:2.3:a:apple:cups:1.1.10:::::::* cpe:2.3:a:apple:cups:1.1.1:::::::* cpe:2.3:a:apple:cups:1.1:::::::* cpe:2.3:a:apple:cups:::::::: cpe:2.3:a:apple:cups:-:::::::*	116
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::* cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:::::*	3
Os	Fedoraproject Fedora cpe:2.3:o:fedoraproject:fedora:20:::::::*	1

Nessus® Vulnerability Scanner

Date	Description
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-108.nasl - Type : ACT_GATHER_INFO
2015-03-26	Name : The remote Debian host is missing a security update. File : debian_DLA-22.nasl - Type : ACT_GATHER_INFO
2014-11-26	Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2014-0035.nasl - Type : ACT_GATHER_INFO
2014-11-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1388.nasl - Type : ACT_GATHER_INFO
2014-11-04	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20141014_cups_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-11-03	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-438.nasl - Type : ACT_GATHER_INFO
2014-10-17	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1388.nasl - Type : ACT_GATHER_INFO
2014-10-17	Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit... File : macosx_10_10.nasl - Type : ACT_GATHER_INFO
2014-10-14	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1388.nasl - Type : ACT_GATHER_INFO
2014-10-03	Name : The remote Fedora host is missing a security update. File : fedora_2014-9703.nasl - Type : ACT_GATHER_INFO
2014-08-15	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_cups-140729.nasl - Type : ACT_GATHER_INFO
2014-08-12	Name : The remote print service is potentially affected by an information disclosure... File : cups_1_7_5.nasl - Type : ACT_GATHER_INFO
2014-08-07	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-151.nasl - Type : ACT_GATHER_INFO
2014-07-31	Name : The remote Fedora host is missing a security update. File : fedora_2014-8752.nasl - Type : ACT_GATHER_INFO
2014-07-31	Name : The remote print service is potentially affected by an information disclosure... File : cups_1_7_4.nasl - Type : ACT_GATHER_INFO
2014-07-28	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2990.nasl - Type : ACT_GATHER_INFO
2014-07-22	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2293-1.nasl - Type : ACT_GATHER_INFO
2014-07-21	Name : The remote Fedora host is missing a security update. File : fedora_2014-8351.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://advisories.mageia.org/MGASA-2014-0313.html
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135528.html
http://rhn.redhat.com/errata/RHSA-2014-1388.html
http://secunia.com/advisories/59945
http://secunia.com/advisories/60273
http://secunia.com/advisories/60787
http://www.cups.org/blog.php?L724
http://www.cups.org/str.php?L4450
http://www.mandriva.com/security/advisories?name=MDVSA-2015:108
http://www.securityfocus.com/bid/68788
http://www.securitytracker.com/id/1030611
http://www.ubuntu.com/usn/USN-2293-1
https://bugzilla.redhat.com/show_bug.cgi?id=1115576
https://support.apple.com/kb/HT6535

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 12:40:54	Multiple Updates
2024-02-16 12:24:44	Multiple Updates
2023-02-13 05:28:19	Multiple Updates
2023-02-02 21:28:32	Multiple Updates
2021-05-04 12:32:23	Multiple Updates
2021-04-22 01:39:26	Multiple Updates
2020-05-23 01:52:10	Multiple Updates
2020-05-23 00:41:05	Multiple Updates
2017-01-07 09:25:35	Multiple Updates
2016-06-28 22:51:14	Multiple Updates
2016-04-27 00:51:56	Multiple Updates
2015-10-29 21:22:44	Multiple Updates
2015-04-22 00:26:07	Multiple Updates
2015-04-21 09:24:59	Multiple Updates
2015-04-15 09:27:59	Multiple Updates
2015-03-31 13:28:30	Multiple Updates
2015-03-27 13:28:11	Multiple Updates
2014-11-27 13:28:31	Multiple Updates
2014-11-13 13:27:01	Multiple Updates
2014-11-05 13:28:34	Multiple Updates
2014-11-05 13:27:53	Multiple Updates
2014-11-04 13:27:30	Multiple Updates
2014-10-24 13:26:37	Multiple Updates
2014-10-18 13:26:00	Multiple Updates
2014-10-16 13:25:24	Multiple Updates
2014-10-04 13:29:25	Multiple Updates
2014-08-16 13:27:19	Multiple Updates
2014-08-13 13:24:52	Multiple Updates
2014-08-08 13:24:46	Multiple Updates
2014-08-01 13:25:01	Multiple Updates
2014-07-29 13:25:41	Multiple Updates
2014-07-23 21:25:33	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	120
Sources(s)	15
Nessus® Exploit(s)	18

	Related
6.8	MDVSA-2015:108
5	RHSA-2014:1388
5	MDVSA-2014:151
5	DSA-2990
5	CVE-2014-5031
1.9	CVE-2014-5030
1.5	CVE-2014-5029
1.2	USN-2293-1
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 8 more Alert(s)

1.2 - CVE-2014-3537

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU