Vulnerability Details : CVE-2013-6476
The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local users to gain privileges via a Trojan horse driver in the same directory as the PDF file.
Products affected by CVE-2013-6476
- cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:*:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.44:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.43:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.35:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.34:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.27:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.26:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.45:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.38:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.36:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.29:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.37:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.40:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.39:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.31:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.30:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.42:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.41:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.33:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.32:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:linuxfoundation:cups-filters:1.0.23:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-6476
0.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 27 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-6476
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST |
CWE ids for CVE-2013-6476
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-6476
-
https://bugzilla.redhat.com/show_bug.cgi?id=1027551
1027551 – (CVE-2013-6476) CVE-2013-6476 cups-filters: pdftoopvp could load drivers from an attacker-controlled directory
-
http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7176
/openprinting/cups-filters : revision 7176Patch
-
http://www.debian.org/security/2014/dsa-2875
Debian -- Security Information -- DSA-2875-1 cups-filters
-
http://www.debian.org/security/2014/dsa-2876
Debian -- Security Information -- DSA-2876-1 cups
-
http://www.ubuntu.com/usn/USN-2143-1
USN-2143-1: cups-filters vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2144-1
USN-2144-1: CUPS vulnerabilities | Ubuntu security notices
Jump to