cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Cups | — | Apply OS X security update 2009-001 | Dec 16, 2011 | Nov 20, 2008 |
| Centos_linux | — | Upgrade cupsUpgrade cups-libsUpgrade cups-develUpgrade cups-lpd | Dec 1, 2016 | Nov 20, 2008 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Nov 21, 2008 |
| Oracle_linux | — | Upgrade cups-libsUpgrade cupsUpgrade cups-develUpgrade cups-lpd | Oct 16, 2024 | Nov 21, 2008 |
| Suse | — | Upgrade cups-clientUpgrade cups-libs-32bitUpgrade cups-develUpgrade cupsUpgrade cups-libsUpgrade cups-libs-64bit | Feb 17, 2015 | Nov 20, 2008 |
| Ubuntu | — | Upgrade cupsUpgrade cupsys | Nov 8, 2024 | Nov 21, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub