The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has cups packages installed that are affected by multiple vulnerabilities:

  - A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in     conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither     the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
    (CVE-2017-18190)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave     10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a     privileged network position may be able to execute arbitrary code. (CVE-2019-8675, CVE-2019-8696)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - cups: DNS rebinding attacks via incorrect whitelist     (CVE-2017-18190)

  - cups: stack-buffer-overflow in libcups's asn1_get_type     function (CVE-2019-8675)

  - cups: stack-buffer-overflow in libcups's asn1_get_packed     function (CVE-2019-8696)

This update for cups fixes the following issues :

  - CVE-2017-18190: Removed localhost.localdomain from list     of trustworthy hosts in scheduler/client.c to avoid     arbitrary IPP command execution in conjunction with DNS     rebinding. (bsc#1081557)

This update was imported from the SUSE:SLE-12:Update update project.

Two vulnerabilities affecting the cups printing server were found which can lead to arbitrary IPP command execution and denial of service.

CVE-2017-18190

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

CVE-2017-18248

The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.

For Debian 8 'Jessie', these problems have been fixed in version 1.7.5-11+deb8u3.

We recommend that you upgrade your cups packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3864 advisory.

  - A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in     conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither     the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
    (CVE-2017-18190)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave     10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a     privileged network position may be able to execute arbitrary code. (CVE-2019-8675, CVE-2019-8696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.0.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - CUPS printing system provides a portable printing layer     for UNIXA(r) operating systems. It has been developed by     Apple Inc.to promote a standard printing solution for     all UNIX vendors and users.CUPS provides the System V     and Berkeley command-line interfaces.

  - Security fix(es):

  - A localhost.localdomain whitelist entry in valid_host()     in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by     sending POST requests to the CUPS daemon in conjunction     with DNS rebinding. The localhost.localdomain name is     often resolved via a DNS server (neither the OS nor the     web browser is responsible for ensuring that     localhost.localdomain is 127.0.0.1).(CVE-2017-18190)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A cross-site scripting flaw was found in the cups web     templating engine. An attacker could use this flaw to     bypass the default configuration settings that bind the     CUPS scheduler to the 'localhost' or loopback     interface.(CVE-2015-1159)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5031)

  - A string reference count bug was found in cupsd,     causing premature freeing of string objects. An     attacker could submit a malicious print job that     exploits this flaw to dismantle ACLs protecting     privileged operations, allowing a replacement     configuration file to be uploaded, which in turn     allowed the attacker to run arbitrary code on the CUPS     server.(CVE-2015-1158)

  - A cross-site scripting (XSS) flaw was found in the CUPS     web interface. An attacker could use this flaw to     perform a cross-site scripting attack against users of     the CUPS web interface.(CVE-2014-2856)

  - A localhost.localdomain whitelist entry in valid_host()     in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by     sending POST requests to the CUPS daemon in conjunction     with DNS rebinding. The localhost.localdomain name is     often resolved via a DNS server (neither the OS nor the     web browser is responsible for ensuring that     localhost.localdomain is 127.0.0.1).(CVE-2017-18190)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-5030)

  - It was discovered that CUPS allowed certain users to     create symbolic links in certain directories under     /var/cache/cups/. A local user with the 'lp' group     privileges could use this flaw to read the contents of     arbitrary files on the system or, potentially, escalate     their privileges on the system.(CVE-2014-3537)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the way CUPS handled     compressed raster image files. An attacker could create     a specially crafted image file that, when passed via     the CUPS Raster filter, could cause the CUPS filter to     crash.(CVE-2014-9679)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1506 advisory.

    A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows     remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in     conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither     the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
    (CVE-2017-18190)

    Stack-buffer-overflow in libcups's asn1_get_type function. (CVE-2019-8675)

    Stack-buffer-overflow in libcups's asn1_get_packed function. (CVE-2019-8696)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-557:05 advisory.

    cups: DNS rebinding attacks via incorrect whitelist (CVE-2017-18190)         cups: stack-buffer-overflow in libcups's asn1_get_type function (CVE-2019-8675)         cups: stack-buffer-overflow in libcups's asn1_get_packed function (CVE-2019-8696)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3864 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: DNS rebinding attacks via incorrect whitelist (CVE-2017-18190)

    * cups: stack-buffer-overflow in libcups's asn1_get_type function (CVE-2019-8675)

    * cups: stack-buffer-overflow in libcups's asn1_get_packed function (CVE-2019-8696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3864 advisory.

    - 1823758 - CVE-2017-18190 cups: DNS rebinding attacks via incorrect whitelist [rhel-7]
    - 1774460 - CVE-2019-8696 cups: stack-buffer-overflow in libcupss asn1_get_packed function [rhel-7]
    - 1774461 - CVE-2019-8675 cups: stack-buffer-overflow in libcupss asn1_get_type function [rhel-7]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
154447	NewStart CGSL CORE 5.05 / MAIN 5.05 : cups Multiple Vulnerabilities (NS-SA-2021-0161)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2023/11/27	high
141746	Scientific Linux Security Update : cups on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
107180	openSUSE Security Update : cups (openSUSE-2018-225)	Nessus	SuSE Local Security Checks	2018/3/7	2025/10/24	high
110909	Debian DLA-1412-1 : cups security update	Nessus	Debian Local Security Checks	2018/7/5	2024/9/6	high
141611	CentOS 7 : cups (RHSA-2020:3864)	Nessus	CentOS Local Security Checks	2020/10/20	2024/10/9	high
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
109478	EulerOS 2.0 SP2 : cups (EulerOS-SA-2018-1080)	Nessus	Huawei Local Security Checks	2018/5/2	2024/10/15	high
124935	EulerOS Virtualization 3.0.1.0 : cups (EulerOS-SA-2019-1432)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
141996	Amazon Linux 2 : cups (ALAS-2020-1506)	Nessus	Amazon Linux Local Security Checks	2020/10/28	2024/12/11	high
294460	MiracleLinux 7 : cups-1.6.3-51.el7 (AXSA:2020-557:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
143068	RHEL 7 : cups (RHSA-2020:3864)	Nessus	Red Hat Local Security Checks	2020/11/19	2024/11/7	high
141234	Oracle Linux 7 : cups (ELSA-2020-3864)	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/11/1	high
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	2022/9/1	2025/7/22	critical

检测

插件搜索

high

high

high

high

high

critical

critical

high

high

high

high

high

high

critical