title: AppArmor cupsd Sandbox Bypass Due to Use of Hard Links
description: The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS.
problem types: Escape from sandbox confinement
affected:
{
platforms: Ubuntu 18.04 LTS
product: cups
vendor: n/a
versions:
lessThan: 2.2.7-1ubuntu2.1, status: affected, version: unspecified, versionType: custom
}
{
platforms: Ubuntu 17.10
product: cups
vendor: n/a
versions:
lessThan: 2.2.4-7ubuntu3.1, status: affected, version: unspecified, versionType: custom
}
{
platforms: Ubuntu 16.04 LTS
product: cups
vendor: n/a
versions:
lessThan: 2.1.3-4ubuntu0.5, status: affected, version: unspecified, versionType: custom
}
{
platforms: Ubuntu 14.04 LTS
product: cups
vendor: n/a
versions:
lessThan: 1.7.2-0ubuntu1.10, status: affected, version: unspecified, versionType: custom
}
