The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Cups | — | Apply OS X security update 2009-005 | Dec 16, 2011 | Jun 9, 2009 |
| Centos_linux | — | Upgrade cups-develUpgrade cups-lpdUpgrade cupsUpgrade cups-libs | Dec 1, 2016 | Jun 9, 2009 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Jun 9, 2009 |
| Oracle_linux | — | Upgrade cups-libsUpgrade cupsUpgrade cups-develUpgrade cups-lpd | Oct 16, 2024 | Jun 9, 2009 |
| Suse | — | Upgrade cupsUpgrade cups-develUpgrade cups-libs-32bitUpgrade cups-clientUpgrade cups-libs-x86Upgrade cups-libs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cupsUpgrade cupsys | Nov 8, 2024 | Jun 9, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub