CVE-2014-8166

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-12 · updated 2026-06-17
Weakness: CWE-20

Description

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.

Affected products

cups: before 1.6 — fixed in 1.6

How to fix

Upgrade to a fixed version: cups 1.6. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2015/03/24/15
http://www.openwall.com/lists/oss-security/2015/03/24/2
http://www.securityfocus.com/bid/73300
https://bugzilla.redhat.com/show_bug.cgi?id=1084577
http://www.openwall.com/lists/oss-security/2015/03/24/15
http://www.openwall.com/lists/oss-security/2015/03/24/2
http://www.securityfocus.com/bid/73300
https://bugzilla.redhat.com/show_bug.cgi?id=1084577

Get alerted when CVE-2014-8166 or the next vulnerability affects your stack