Tim Waugh

The issue arises when the foomatic-rip filter is used insecurely, creating temporary files to store PostScript data while the debug mode is enabled. This can be exploited by a local attacker to conduct symlink attacks, allowing them to overwrite arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.

The issue allows a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter. This is possible because the foomatic-rip filter insecurely creates temporary files for storage of PostScript data when the debug mode is enabled.

The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files, potentially leading to disruption of confidentiality, integrity, and availability of protected information. A local attacker can exploit this to cause harm.

The issue is related to a use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function, which can be exploited remotely to cause a denial of service, such as a daemon crash or hang. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited when kqueue or epoll is used, and it is related to improperly maintaining a reference count.

The issue is related to a use-after-free vulnerability in the abstract file-descriptor handling interface in the `cupsdDoSelect` function. This vulnerability allows remote attackers to cause a denial of service, resulting in a daemon crash or hang, by disconnecting during the listing of a large number of print jobs. The problem is caused by improperly maintaining a reference count.

The issue is related to multiple vulnerabilities in the CUPS package and its related components in the Debian GNU/Linux operating system. These vulnerabilities can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. The cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.