CVSS: 7.5EPSS: 0%CPEs: 61EXPL: 0CVE-2015-8560 – cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character
https://notcve.org/view.php?id=CVE-2015-8560
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job, a different vulnerability than CVE-2015-8327. Vulnerabilidad de lista negra incompleta en util.c en foomatic-rip en cups-filters 1.0.42 en versiones anteriores a 1.4.0 y en foomatic-filters en Foomatic 4.0.x permite a atacantes remotos ejecutar comandos arbitrarios a través de un carácter ; (punto y coma) en un trabajo de impresión, una vulnerabilidad diferente a CVE-2015-8327. It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. • http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/annotate/head:/NEWS http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7419 http://rhn.redhat.com/errata/RHSA-2016-0491.html http://www.debian.org/security/2015/dsa-3419 http://www.debian.org/security/2015/dsa-3429 http://www.openwall.com/lists/oss-security/2015/12/13/2 http://www.openwall.com/lists/oss-security/2015/12/14/13 http://www.oracle.com/technetwork/topics/security/linuxbull • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 2%CPEs: 64EXPL: 0CVE-2015-8327 – cups-filters: foomatic-rip did not consider the back tick as an illegal shell escape character
https://notcve.org/view.php?id=CVE-2015-8327
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job. Vulnerabilidad de lista negra incompleta en util.c en foomatic-rip en cups-filters 1.0.42 en versiones anteriores a 1.2.0 y en foomatic-filters en Foomatic 4.0.x permite a atacantes remotos ejecutar comandos arbitrarios a través de caracteres ` (acento grave) en un trabajo de impresión. It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. • http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/annotate/head:/NEWS http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7406 http://lists.opensuse.org/opensuse-updates/2016-01/msg00065.html http://rhn.redhat.com/errata/RHSA-2016-0491.html http://www.debian.org/security/2015/dsa-3411 http://www.debian.org/security/2015/dsa-3429 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.securityfocus.com/bid/78524 htt • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.8EPSS: 6%CPEs: 1EXPL: 5CVE-2011-2964 – foomatic: Improper sanitization of command line option in foomatic-rip (foomatic.c)
https://notcve.org/view.php?id=CVE-2011-2964
foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697. foomaticrip.c en foomatic-rip en los foomatic-filters de Foomatic v4.0.6 permite a atacantes remotos ejecutar código de su elección a través de un campo *FoomaticRIPCommandLine debidamente modificado en un archivo .ppd. Se trata de una vulnerabilidad diferente a la CVE-2011-2697. • http://secunia.com/advisories/45477 http://security.gentoo.org/glsa/glsa-201203-07.xml http://www.mandriva.com/security/advisories?name=MDVSA-2011:125 http://www.openwall.com/lists/oss-security/2011/07/13/3 http://www.openwall.com/lists/oss-security/2011/07/18/3 http://www.openwall.com/lists/oss-security/2011/07/28/1 http://www.redhat.com/support/errata/RHSA-2011-1110.html http://www.ubuntu.com/usn/USN-1194-1 http://www.xerox.com/download/security/se • CWE-94: Improper Control of Generation of Code ('Code Injection') •