cups: multiple issues

• CVE-2015-1158 (arbitrary code execution, privilege escalation)

An issue with how localized strings are handled in cupsd allows a
reference counter to over-decrement when handling certain print job
request errors. As a result, an attacker can prematurely free an
arbitrary string of global scope, creating a dangling pointer to a
repurposed block of memory on the heap. The dangling pointer causes ACL
verification to fail when parsing ‘admin/conf’ and ‘admin’ ACLs. The ACL
handling failure results in unrestricted access to privileged
operations, allowing an unauthenticated remote user to upload a
replacement CUPS configuration file and mount further attacks.

• CVE-2015-1159 (cross-side scripting)

A cross-site scripting bug in the CUPS templating engine allows this bug
to be exploited when a user browses the web. In certain cases, the CGI
template can echo user input to file rather than escaping the text
first. This may be used to set up a reflected XSS attack in the QUERY
parameter of the web interface help page. By default, many linux
distributions run with the web interface activated.