CVE-2008-2940 Privilege escalation in n/a

High 7.2 Published 14 Aug 2008 Updated 7 Aug 2024

Local attackers can exploit HPLIP alert-mailing flaws to gain root privileges and send emails, requiring a software upgrade.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2008-2940?

CVE-2008-2940 is a high-severity vulnerability in n/a, published on 14 Aug 2008. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The alert-mailing implementation in HP Linux Imaging and Printing (HPLIP) 1.6.7 allows local users to gain privileges and send e-mail messages from the root account via vectors related to the setalerts message, and lack of validation of the device URI associated with an event message.

Weakness: CWE-264

Which versions are affected by CVE-2008-2940?

It affects 1 product.

Products include Hp Linux Imaging and Printing Project.

How do I fix CVE-2008-2940?

Upgrade to a fixed version.

Is CVE-2008-2940 being exploited?

There is no known exploitation of CVE-2008-2940 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2008-2940, GHSA-5gwr-h45h-hxgj.