{"id":"CVE-2015-1158","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-1158","generatedAt":"2026-11-05T06:13:11.677Z","title":"The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via…","description":"The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.","published":"2015-06-26T10:59:00.000Z","lastModified":"2026-06-17T00:21:53.000Z","status":"Modified","sourceIdentifier":"product-security@apple.com","cvss":{"version":"2.0","score":10,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C"},"cwe":["CWE-254"],"affected":["cups/cups"],"epss":{"score":0.29726,"percentile":0.98203,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":2,"verified":true,"firstPublished":"2015-06-22","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":41233,"kind":"exploit","title":"CUPS < 2.0.3 - Remote Command Execution","url":"https://www.exploit-db.com/exploits/41233","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/41233.py","file":"exploits/linux/remote/41233.py","published":"2017-02-03","added":"2017-02-03","updated":"2018-04-12","author":"@0x00string","type":"remote","platform":"linux","port":null,"verified":false,"codes":["CVE-2015-1158"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comcups-2.0.2-source.tar.gz","screenshotUrl":null,"referenceUrl":"https://github.com/0x00string/oldays/blob/ab7fdbce3f614fa4f8b62ea9b79bce2da0a0f278/CVE-2015-1158.py"},{"edbId":37336,"kind":"exploit","title":"CUPS < 2.0.3 - Multiple Vulnerabilities","url":"https://www.exploit-db.com/exploits/37336","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/37336.txt","file":"exploits/multiple/remote/37336.txt","published":"2015-06-22","added":"2015-06-22","updated":"2017-02-03","author":"Google Security Research","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2015-1158","OSVDB-123116"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comcups-2.0.2-source.tar.gz","screenshotUrl":null,"referenceUrl":"http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 29.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html","source":"product-security@apple.com"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702","source":"product-security@apple.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html","source":"product-security@apple.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html","source":"product-security@apple.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html","source":"product-security@apple.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1123.html","source":"product-security@apple.com"},{"url":"http://www.cups.org/blog.php?L1082","tags":["Vendor Advisory"],"source":"product-security@apple.com"},{"url":"http://www.debian.org/security/2015/dsa-3283","source":"product-security@apple.com"},{"url":"http://www.kb.cert.org/vuls/id/810572","tags":["Third Party Advisory","US Government Resource"],"source":"product-security@apple.com"},{"url":"http://www.securityfocus.com/bid/75098","source":"product-security@apple.com"},{"url":"http://www.securitytracker.com/id/1032556","source":"product-security@apple.com"},{"url":"http://www.ubuntu.com/usn/USN-2629-1","source":"product-security@apple.com"},{"url":"https://bugzilla.opensuse.org/show_bug.cgi?id=924208","source":"product-security@apple.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221641","source":"product-security@apple.com"},{"url":"https://code.google.com/p/google-security-research/issues/detail?id=455","source":"product-security@apple.com"},{"url":"https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py","source":"product-security@apple.com"},{"url":"https://security.gentoo.org/glsa/201510-07","source":"product-security@apple.com"},{"url":"https://www.cups.org/str.php?L4609","tags":["Vendor Advisory"],"source":"product-security@apple.com"},{"url":"https://www.exploit-db.com/exploits/37336/","source":"product-security@apple.com"},{"url":"https://www.exploit-db.com/exploits/41233/","source":"product-security@apple.com"},{"url":"http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1123.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.cups.org/blog.php?L1082","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2015/dsa-3283","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.kb.cert.org/vuls/id/810572","tags":["Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/75098","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1032556","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2629-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.opensuse.org/show_bug.cgi?id=924208","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221641","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://code.google.com/p/google-security-research/issues/detail?id=455","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201510-07","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cups.org/str.php?L4609","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/37336/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/41233/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-1158","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}