Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade cups-libsUpgrade cups-lpdUpgrade cupsUpgrade cups-devel | Dec 1, 2016 | Apr 23, 2009 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Apr 23, 2009 |
| Freebsd | — | Upgrade cups-base | Dec 10, 2025 | May 7, 2009 |
| Gentoo Linux | — | Upgrade net-print/cups. | Oct 30, 2017 | Apr 23, 2009 |
| Oracle_linux | — | Upgrade cups-lpdUpgrade cups-develUpgrade cupsUpgrade cups-libs | Oct 16, 2024 | Apr 23, 2009 |
| Suse | — | Upgrade cups-develUpgrade cups-ddkUpgrade libcups2Upgrade cups-libs-32bitUpgrade cups154Upgrade cups-libs-x86Upgrade libcupsimage2Upgrade cups-configUpgrade libcupsppdc1Upgrade cupsUpgrade cups154-filtersUpgrade cups-clientUpgrade cups154-clientUpgrade cups154-libsUpgrade libcupscgi1Upgrade libcupsmime1Upgrade libcups2-32bitUpgrade cups-libs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libcupsimage2 | Nov 8, 2024 | Apr 23, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub