| Description: | CUPS provides a portable printing layer for Linux, UNIX, and similaroperating systems.A cross-site scripting (XSS) flaw was found in the CUPS web interface.An attacker could use this flaw to perform a cross-site scripting attackagainst users of the CUPS web interface. (CVE-2014-2856)It was discovered that CUPS allowed certain users to create symbolic linksin certain directories under /var/cache/cups/. A local user with the 'lp'group privileges could use this flaw to read the contents of arbitraryfiles on the system or, potentially, escalate their privileges on thesystem. (CVE-2014-3537, CVE-2014-5029, CVE-2014-5030, CVE-2014-5031)The CVE-2014-3537 issue was discovered by Francisco Alonso of Red HatProduct Security.These updated cups packages also include several bug fixes. Space precludesdocumenting all of these changes in this advisory. Users are directed tothe Red Hat Enterprise Linux 6.6 Technical Notes, linked to in theReferences section, for information on the most significant of thesechanges.All cups users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. After installing thisupdate, the cupsd daemon will be restarted automatically. |