Candidate: CVE-2014-8166
PublicDate: 2018-01-12 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8166
 http://www.openwall.com/lists/oss-security/2015/03/24/2
Description:
 The browsing feature in the server in CUPS does not filter ANSI escape
 sequences from shared printer names, which might allow remote attackers to
 execute arbitrary code via a crafted printer name.
Ubuntu-Description:
Notes:
 sbeattie> printer names with ANSI escape sequences were allowed, can
 sbeattie> cause issues when doing lpstat -a in a terminal
 sbeattie> requires malicious adding of printers
 mdeslaur> this code was removed in cups 1.6
Bugs:
 https://bugzilla.redhat.com/show_bug.cgi?id=1084577
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [8.8 HIGH]
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H [7.5 HIGH]

Patches_cups:
 redhat: https://bugzilla.redhat.com/attachment.cgi?id=916761
upstream_cups: needs-triage
lucid_cups: ignored (reached end-of-life)
precise_cups: ignored (reached end-of-life)
precise/esm_cups: DNE (precise was needs-triage)
trusty_cups: not-affected (code not present)
trusty/esm_cups: DNE (trusty was not-affected [code not present])
utopic_cups: ignored (reached end-of-life)
vivid_cups: ignored (reached end-of-life)
vivid/stable-phone-overlay_cups: ignored (reached end-of-life)
vivid/ubuntu-core_cups: DNE
wily_cups: ignored (reached end-of-life)
xenial_cups: not-affected (code not present)
esm-infra/xenial_cups: not-affected (code not present)
yakkety_cups: ignored (reached end-of-life)
zesty_cups: ignored (reached end-of-life)
artful_cups: not-affected (code not present)
bionic_cups: not-affected (code not present)
devel_cups: not-affected (code not present)