CVE-2014-5029: Apple Cups

Low severity, CVSS 1.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.

Affected products

• Apple Cups: version 1.7.4 only
• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only

Published 2014-07-29. Last modified 2026-06-17.