The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade cups | Feb 19, 2019 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cups-filesystemUpgrade cups-lpdUpgrade cups-develUpgrade cups-clientUpgrade cupsUpgrade cups-libs | Dec 4, 2019 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cups-clientUpgrade cups-filesystemUpgrade cups-develUpgrade cups-libsUpgrade cupsUpgrade cups-lpd | Dec 18, 2019 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cups-develUpgrade cups-lpdUpgrade cupsUpgrade cups-libsUpgrade cups-clientUpgrade cups-filesystem | Nov 19, 2019 | Mar 26, 2018 |
| Oracle Solaris | — | Upgrade image/ghostscript to version 9.27-11.4.21.0.1.69.0 on Solaris 11.4Upgrade print/cups to version 2.3.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade desktop/pdf-viewer/gsx to version 9.27-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/print/cups-libs to version 2.3.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 26, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 26, 2018 |
| Suse | — | Upgrade cups-configUpgrade libcupsimage2Upgrade libcupsppdc1Upgrade cupsUpgrade libcups2Upgrade cups-develUpgrade cups-ddkUpgrade cups-libs-32bitUpgrade cups-libsUpgrade libcupscgi1Upgrade libcupsmime1Upgrade libcups2-32bitUpgrade cups-client | May 20, 2018 | Mar 26, 2018 |
| Ubuntu | — | Upgrade cups | Jul 24, 2018 | Mar 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub