In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.

The remote NewStart CGSL host, running version MAIN 6.06, has cups packages installed that are affected by multiple vulnerabilities:

  - ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with     invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and     application crash) or possibly execute arbitrary code via a crafted IPP request. (CVE-2010-2941)

  - The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to     execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.
    (CVE-2008-3641)

  - Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others,     allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as     demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka Infinite CPU spins.
    (CVE-2005-3625)

  - Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others,     allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a     null dereference. (CVE-2005-3626)

  - Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor,     and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream     with (1) a large number of components value that is not checked by DCTStream::readBaselineSOF or     DCTStream::readProgressiveSOF, (2) a large Huffman table index value that is not checked by     DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by     DCTStream::readScanInfo. (CVE-2005-3627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the cups package has been released.

The remote host is affected by the vulnerability described in GLSA-201908-08 (CUPS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CUPS. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for cups fixes the following issues :

The following security vulnerabilities were fixed :

  - Fixed a local privilege escalation to root and sandbox     bypasses in the scheduler

  - CVE-2018-4180: Fixed a local privilege escalation to     root in dnssd backend (bsc#1096405)

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406)

  - CVE-2018-4182: Fixed a sandbox bypass due to insecure     error handling (bsc#1096407)

  - CVE-2018-4183: Fixed a sandbox bypass due to profile     misconfiguration (bsc#1096408)

This update was imported from the SUSE:SLE-15:Update update project.

Security fix for CVE-2018-4180 CVE-2018-4181 CVE-2018-4182 CVE-2018-4183

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cups fixes the following issues: The following security vulnerabilities were fixed :

  - Fixed a local privilege escalation to root and sandbox     bypasses in the scheduler

  - CVE-2018-4180: Fixed a local privilege escalation to     root in dnssd backend (bsc#1096405)

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406)

  - CVE-2018-4182: Fixed a sandbox bypass due to insecure     error handling (bsc#1096407)

  - CVE-2018-4183: Fixed a sandbox bypass due to profile     misconfiguration (bsc#1096408)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cups fixes the following issues: Security issues fixed :

  - CVE-2018-4180: Fix local privilege escalation to root in     dnssd backend (bsc#1096405).

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406).

  - CVE-2018-4182: Fix cups-exec sandbox bypass due to     insecure error handling (bsc#1096407).

  - CVE-2018-4183: Fix cups-exec sandbox bypass due to     profile misconfiguration (bsc#1096408).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cups fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2017-18248: Handle invalid characters properly in     printing jobs. This fixes a problem that was causing the     DBUS library to abort the calling process. (bsc#1061066     bsc#1087018)

  - Fixed a local privilege escalation to root and sandbox     bypasses in the scheduler

  - CVE-2018-4180: Fixed a local privilege escalation to     root in dnssd backend (bsc#1096405)

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406)

  - CVE-2018-4182: Fixed a sandbox bypass due to insecure     error handling (bsc#1096407)

  - CVE-2018-4183: Fixed a sandbox bypass due to profile     misconfiguration (bsc#1096408)

The following other issue was fixed :

  - Fixed authorization check for clients (like samba)     connected through the local socket when Kerberos     authentication is enabled (bsc#1050082)

This update was imported from the SUSE:SLE-12:Update update project.

This update for cups fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2017-18248: Handle invalid characters properly in     printing jobs. This fixes a problem that was causing the     DBUS library to abort the calling process. (bsc#1061066     bsc#1087018)

  - Fixed a local privilege escalation to root and sandbox     bypasses in the scheduler

  - CVE-2018-4180: Fixed a local privilege escalation to     root in dnssd backend (bsc#1096405)

  - CVE-2018-4181: Limited local file reads as root via     cupsd.conf include directive (bsc#1096406)

  - CVE-2018-4182: Fixed a sandbox bypass due to insecure     error handling (bsc#1096407)

  - CVE-2018-4183: Fixed a sandbox bypass due to profile     misconfiguration (bsc#1096408) The following other issue     was fixed :

  - Fixed authorization check for clients (like samba)     connected through the local socket when Kerberos     authentication is enabled (bsc#1050082)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.5. It is, therefore, affected by multiple vulnerabilities.

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
266283	NewStart CGSL MAIN 6.06 : cups Multiple Vulnerabilities (NS-SA-2025-0218)	Nessus	NewStart CGSL Local Security Checks	critical
204396	Photon OS 4.0: Cups PHSA-2023-4.0-0425	Nessus	PhotonOS Local Security Checks	high
127957	GLSA-201908-08 : CUPS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123253	openSUSE Security Update : cups (openSUSE-2019-583)	Nessus	SuSE Local Security Checks	high
120749	Fedora 28 : 1:cups (2018-bdc5bfaedc)	Nessus	Fedora Local Security Checks	high
120070	SUSE SLED15 / SLES15 Security Update : cups (SUSE-SU-2018:2172-1)	Nessus	SuSE Local Security Checks	high
111633	openSUSE Security Update : cups (openSUSE-2018-852)	Nessus	SuSE Local Security Checks	high
111592	SUSE SLES11 Security Update : cups (SUSE-SU-2018:2233-1)	Nessus	SuSE Local Security Checks	high
111587	openSUSE Security Update : cups (openSUSE-2018-822)	Nessus	SuSE Local Security Checks	high
111508	SUSE SLED12 / SLES12 Security Update : cups (SUSE-SU-2018:2162-1)	Nessus	SuSE Local Security Checks	high
110324	macOS 10.13.x < 10.13.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2018-4182

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

critical