CVE-2014-3537: Apple Cups

Low severity, CVSS 1.2. EPSS: 0.4% chance of exploitation in the next 30 days.

The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.

Affected products

• Apple Cups: up to and including 1.7.3; version 1.7 only; version 1.7.0 only; version 1.7.1 only; version 1.7.2 only
• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only
• Fedoraproject Fedora: version 20 only

Published 2014-07-23. Last modified 2026-06-17.