Описание
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions.
Отчет
This vulnerability allows an unauthenticated attacker to achieve arbitrary code execution and privilege escalation, among other security impacts. HPLIP provides printer drivers and tools for managing HP devices. The client tools are not exposed to the network. Printer, scanner, and fax drivers are used by CUPS (once configured with a print queue). The driver binaries are executed within a restricted environment under the unprivileged 'lp' user. This limits exploitation to a local attacker and restricts code execution to the unprivileged 'lp' user. For these reasons, this issue has been rated with an important severity. Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.
Меры по смягчению последствий
To mitigate this vulnerability, consider removing the hplip package if its functionality is not required by using the command indicated below. Note this will remove HP printer support and related utilities from the system.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | hplip | Out of support scope | ||
| Red Hat Enterprise Linux 7 | hplip | Affected | ||
| Red Hat Enterprise Linux 10 | hplip | Fixed | RHSA-2026:82883 | 14.10.2026 |
| Red Hat Enterprise Linux 8 | hplip | Fixed | RHSA-2026:82295 | 13.10.2026 |
| Red Hat Enterprise Linux 9 | hplip | Fixed | RHSA-2026:82882 | 14.10.2026 |
Показывать по
Дополнительная информация
Статус:
8.4 High
CVSS3
Связанные уязвимости
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
HP has identified and remediated multiple externally reported vulnerab ...
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
ALT-PU-2026-16571: package `hplip` update to version 3.26.6-alt2
8.4 High
CVSS3