Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Cups | — | Apply OS X security update 2010-001 | Dec 16, 2011 | Nov 19, 2009 |
| Centos_linux | — | Upgrade cups-develUpgrade cups-lpdUpgrade cupsUpgrade cups-libs | Dec 1, 2016 | Nov 19, 2009 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Nov 20, 2009 |
| Gentoo Linux | — | Upgrade net-print/cups. | Oct 30, 2017 | Nov 19, 2009 |
| Oracle_linux | — | Upgrade cups-develUpgrade cups-lpdUpgrade cups-libsUpgrade cups | Oct 16, 2024 | Nov 20, 2009 |
| Suse | — | Upgrade cups-configUpgrade cups-develUpgrade cupsUpgrade cups-libs-x86Upgrade cups154-filtersUpgrade cups-ddkUpgrade libcupsimage2Upgrade libcups2Upgrade cups-libs-32bitUpgrade cups154Upgrade libcupsppdc1Upgrade libcups2-32bitUpgrade cups-libsUpgrade libcupsmime1Upgrade cups154-clientUpgrade cups154-libsUpgrade libcupscgi1Upgrade cups-client | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cupsys-clientUpgrade cups-clientUpgrade cupsysUpgrade cups | Nov 8, 2024 | Nov 20, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub