CVE-2015-0839

The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
hplinux_imaging_and_printing
𝑥
≤ 3.17.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
hplip
bookworm
3.22.10+dfsg0-2
fixed
bullseye
3.21.2+dfsg1-2
fixed
sid
3.22.10+dfsg0-5.1
fixed
squeeze
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
hplip
precise
Fixed 3.12.2-1ubuntu3.5
released
trusty
Fixed 3.14.3-0ubuntu3.4
released
utopic
ignored
vivid
Fixed 3.15.2-0ubuntu4.2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
hplip
suse enterprise sap 12 SP5
3.16.11-1.33
fixed
suse enterprise server 12 SP3
3.16.11-1.33
fixed
suse enterprise server 12 SP4
3.16.11-1.33
fixed
suse enterprise server 12 SP5
3.16.11-1.33
fixed
hplip-devel
suse enterprise desktop 15
3.17.9-3.38
fixed
suse enterprise desktop 15 SP1
3.18.6-5.7.1
fixed
suse enterprise desktop 15 SP2
3.19.12-1.72
fixed
suse enterprise desktop 15 SP3
3.20.11-2.1
fixed
suse enterprise desktop 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise desktop 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise desktop 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise desktop 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise sap 15
3.17.9-3.38
fixed
suse enterprise sap 15 SP1
3.18.6-5.7.1
fixed
suse enterprise sap 15 SP2
3.19.12-1.72
fixed
suse enterprise sap 15 SP3
3.20.11-2.1
fixed
suse enterprise sap 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise sap 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise sap 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise sap 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise server 15
3.17.9-3.38
fixed
suse enterprise server 15 SP1
3.18.6-5.7.1
fixed
suse enterprise server 15 SP2
3.19.12-1.72
fixed
suse enterprise server 15 SP3
3.20.11-2.1
fixed
suse enterprise server 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise server 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise server 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise server 15 SP7
3.24.4-150700.2.6
fixed
hplip-hpijs
suse enterprise desktop 15
3.17.9-3.38
fixed
suse enterprise desktop 15 SP1
3.18.6-5.7.1
fixed
suse enterprise desktop 15 SP2
3.19.12-1.72
fixed
suse enterprise desktop 15 SP3
3.20.11-2.1
fixed
suse enterprise desktop 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise desktop 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise desktop 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise desktop 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise sap 12 SP5
3.16.11-1.33
fixed
suse enterprise sap 15
3.17.9-3.38
fixed
suse enterprise sap 15 SP1
3.18.6-5.7.1
fixed
suse enterprise sap 15 SP2
3.19.12-1.72
fixed
suse enterprise sap 15 SP3
3.20.11-2.1
fixed
suse enterprise sap 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise sap 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise sap 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise sap 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise server 12 SP3
3.16.11-1.33
fixed
suse enterprise server 12 SP4
3.16.11-1.33
fixed
suse enterprise server 12 SP5
3.16.11-1.33
fixed
suse enterprise server 15
3.17.9-3.38
fixed
suse enterprise server 15 SP1
3.18.6-5.7.1
fixed
suse enterprise server 15 SP2
3.19.12-1.72
fixed
suse enterprise server 15 SP3
3.20.11-2.1
fixed
suse enterprise server 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise server 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise server 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise server 15 SP7
3.24.4-150700.2.6
fixed
hplip-sane
suse enterprise desktop 15
3.17.9-3.38
fixed
suse enterprise desktop 15 SP1
3.18.6-5.7.1
fixed
suse enterprise desktop 15 SP2
3.19.12-1.72
fixed
suse enterprise desktop 15 SP3
3.20.11-2.1
fixed
suse enterprise desktop 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise desktop 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise desktop 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise desktop 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise sap 12 SP5
3.16.11-1.33
fixed
suse enterprise sap 15
3.17.9-3.38
fixed
suse enterprise sap 15 SP1
3.18.6-5.7.1
fixed
suse enterprise sap 15 SP2
3.19.12-1.72
fixed
suse enterprise sap 15 SP3
3.20.11-2.1
fixed
suse enterprise sap 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise sap 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise sap 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise sap 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise server 12 SP3
3.16.11-1.33
fixed
suse enterprise server 12 SP4
3.16.11-1.33
fixed
suse enterprise server 12 SP5
3.16.11-1.33
fixed
suse enterprise server 15
3.17.9-3.38
fixed
suse enterprise server 15 SP1
3.18.6-5.7.1
fixed
suse enterprise server 15 SP2
3.19.12-1.72
fixed
suse enterprise server 15 SP3
3.20.11-2.1
fixed
suse enterprise server 15 SP4
3.21.10-150400.1.9
fixed
suse enterprise server 15 SP5
3.21.10-150400.3.5.1
fixed
suse enterprise server 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise server 15 SP7
3.24.4-150700.2.6
fixed
hplip-udev-rules
suse enterprise desktop 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise desktop 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise sap 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise sap 15 SP7
3.24.4-150700.2.6
fixed
suse enterprise server 15 SP6
3.23.8-150600.2.3
fixed
suse enterprise server 15 SP7
3.24.4-150700.2.6
fixed
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162442.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162880.html
http://www.openwall.com/lists/oss-security/2015/05/29/2
http://www.securityfocus.com/bid/74913
http://www.ubuntu.com/usn/USN-2699-1
https://bugs.launchpad.net/hplip/+bug/1432516
https://bugzilla.redhat.com/show_bug.cgi?id=1227252
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162442.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162880.html
http://www.openwall.com/lists/oss-security/2015/05/29/2
http://www.securityfocus.com/bid/74913
http://www.ubuntu.com/usn/USN-2699-1
https://bugs.launchpad.net/hplip/+bug/1432516
https://bugzilla.redhat.com/show_bug.cgi?id=1227252