Security readout for executives and security teams
Plain-English summary
CVE-2011-2923 is a local file overwrite risk in the foomatic-rip print filter. When debug mode is enabled, temporary PostScript data handling can be abused through symlinks, allowing a local attacker to overwrite files reachable by the user account running the filter.
Executive priority
Treat as targeted operational risk, not an internet-scale emergency based on the supplied evidence. Prioritize shared print servers, multi-user Linux systems, and environments where local users should not gain file overwrite opportunities.
Technical view
The issue affects foomatic-filters/foomatic-rip according to the source bundle, described as all versions. The vulnerable condition is debug-mode rendering that creates temporary files insecurely for PostScript data. Impact is local symlink-based arbitrary file overwrite within the privileges of the foomatic-rip process user.
Likely exposure
Exposure is most likely on Linux or Unix print servers and desktops using foomatic-filters, especially where foomatic-rip debug mode is enabled and untrusted local users can submit print jobs or access the host.
Exploitation context
The bundle does not show KEV listing, public exploitation, CVSS, or confirmed remote exploitability. The described attack requires local access and depends on debug mode plus writable temporary-file behavior.
Researcher notes
Evidence is incomplete: no CVSS, CWE, patch version, or active exploitation source is provided. Focus analysis on debug-mode configuration, temporary-file creation behavior, process privileges, and vendor package history.
Mitigation direction
- Check vendor advisories for fixed or backported foomatic-filters packages.
- Disable foomatic-rip debug mode where it is not operationally required.
- Restrict local access to print servers and shared desktop systems.
- Review print service accounts and reduce unnecessary file write privileges.
- Prioritize updates on multi-user systems with local print access.
Validation and detection
- Inventory hosts with foomatic-filters or foomatic-rip installed.
- Determine whether foomatic-rip debug mode is enabled.
- Identify the user context used by the print filter process.
- Check Debian, Red Hat, and SUSE advisories for package status.
- Review local print server access by untrusted users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2011-2923 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://security-tracker.debian.org/tracker/CVE-2011-2923CVE reference · x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2923CVE reference · x_refsource_MISC
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-2923CVE reference · x_refsource_MISC
- https://access.redhat.com/security/cve/cve-2011-2923CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.