Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Mageia 9 MGASA-2024-0227 Critical: Cups Arbitrary Access Issue

mageia
Calendar Grey June 17, 2024
Dist Mageia Esm H88
The latest releases of Mageia's cups packages address a critical vulnerability associated with world-readable permissions on symlinks.
When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument,...

Summary

When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.

References

- https://bugs.mageia.org/show_bug.cgi?id=33293

- https://www.openwall.com/lists/oss-security/2024/06/11/1

- https://www.cve.org/CVERecord?id=CVE-2024-35235

Topics%20covered

Topics Covered

security advisory security issue access control cups Mageia

Resolution

SRPMS

- 9/core/cups-2.4.6-1.2.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 17 Jun 2024
URL: https://advisories.mageia.org/MGASA-2024-0227.html
Type: security
CVE: CVE-2024-35235

Topics%20covered

Topics Covered

security advisory security issue access control cups Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here