Bug 3579

Summary:	Security Advisory - cups - CVE-2012-5519
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Li Wang <li.wang>
Component:	core	Assignee:	Li Wang <li.wang>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium	CC:	jessica.zhang, li.wang, meta.mr.watcher, meta.watcher, ross.burton, sgw, song.liu, zhenfeng.zhao
Version:	1.4
Target Milestone:	Future
Hardware:	x86
OS:	Multiple
Whiteboard:	P3
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	---

Description Li Wang 2012-12-13 04:14:41 UTC

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5519

Comment 1 Ross Burton 2013-03-01 11:03:34 UTC

This has been integrated into master and will be in 1.3.1.