cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Cups | — | Apply OS X security update 2009-001 | Dec 16, 2011 | Nov 20, 2008 |
| Centos_linux | — | Upgrade cups-lpdUpgrade cups-develUpgrade cups-libsUpgrade cups | Dec 1, 2016 | Nov 20, 2008 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Nov 21, 2008 |
| Oracle_linux | — | Upgrade cupsUpgrade cups-libsUpgrade cups-lpdUpgrade cups-devel | Oct 16, 2024 | Nov 21, 2008 |
| Suse | — | Upgrade cups-libs-64bitUpgrade cups-libs-32bitUpgrade cups-libsUpgrade cups-develUpgrade cups-clientUpgrade cups | Feb 17, 2015 | Nov 20, 2008 |
| Ubuntu | — | Upgrade cupsysUpgrade cups | Nov 8, 2024 | Nov 21, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub