CVE-2015-1158

CVE-2015-1158 is a critical-severity vulnerability in Cups with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 30% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-254.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 30% (98th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-254
• Affected product: Cups
• Published: 2015-06-26
• Last modified: 2026-06-17

Description

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

Frequently asked questions

What is CVE-2015-1158?

The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.

How severe is CVE-2015-1158?

CVE-2015-1158 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2015-1158 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 30% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-1158?

CVE-2015-1158 affects Cups. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2015-1158?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2015-1158 published?

CVE-2015-1158 was published on 2015-06-26 and last updated on 2026-06-17.

References

• http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00010.html
• http://rhn.redhat.com/errata/RHSA-2015-1123.html
• http://www.cups.org/blog.php?L1082
• http://www.debian.org/security/2015/dsa-3283
• http://www.kb.cert.org/vuls/id/810572
• http://www.securityfocus.com/bid/75098
• http://www.securitytracker.com/id/1032556
• http://www.ubuntu.com/usn/USN-2629-1
• https://bugzilla.opensuse.org/show_bug.cgi?id=924208
• https://bugzilla.redhat.com/show_bug.cgi?id=1221641
• https://code.google.com/p/google-security-research/issues/detail?id=455
• https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py
• https://security.gentoo.org/glsa/201510-07
• https://www.cups.org/str.php?L4609
• https://www.exploit-db.com/exploits/37336/
• https://www.exploit-db.com/exploits/41233/

Affected products (1)

• cpe:2.3:a:cups:cups:*:*:*:*:*:*:*:*

More vulnerabilities in Cups

• CVE-2008-0882 — Critical (CVSS 10.0): Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial…
• CVE-2007-4351 — Critical (CVSS 10.0): Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a denial of…
• CVE-2008-0047 — Critical (CVSS 9.3): Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version…
• CVE-2018-6553 — High (CVSS 8.8): The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could…
• CVE-2014-8166 — High (CVSS 8.8): The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might…
• CVE-2005-4873 — High (CVSS 7.5): Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent…

All CVEs affecting Cups →

Other CWE-254 vulnerabilities

• CVE-2016-5788 — Critical (CVSS 10.0): General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open…
• CVE-2015-3972 — Critical (CVSS 10.0): The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication,…
• CVE-2019-15149 — Critical (CVSS 9.8): core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a…
• CVE-2017-8227 — Critical (CVSS 9.8): Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect…
• CVE-2016-9568 — Critical (CVSS 9.8): A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform…
• CVE-2011-4889 — Critical (CVSS 9.8): The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application…

Browse all CWE-254 vulnerabilities →