The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade cups | Feb 19, 2019 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cupsUpgrade cups-libsUpgrade cups-clientUpgrade cups-filesystemUpgrade cups-lpdUpgrade cups-devel | Dec 4, 2019 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cups-lpdUpgrade cups-clientUpgrade cups-libsUpgrade cups-develUpgrade cupsUpgrade cups-filesystem | Dec 18, 2019 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cups-lpdUpgrade cupsUpgrade cups-develUpgrade cups-libsUpgrade cups-filesystemUpgrade cups-client | Nov 19, 2019 | Mar 26, 2018 |
| Oracle Solaris | — | Upgrade image/ghostscript to version 9.27-11.4.21.0.1.69.0 on Solaris 11.4Upgrade print/cups to version 2.3.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/print/cups-libs to version 2.3.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade desktop/pdf-viewer/gsx to version 9.27-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 26, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 26, 2018 |
| Suse | — | Upgrade cups-configUpgrade cups-develUpgrade libcupsimage2Upgrade libcups2Upgrade cups-libs-32bitUpgrade cupsUpgrade libcupsppdc1Upgrade cups-ddkUpgrade libcupscgi1Upgrade libcups2-32bitUpgrade libcupsmime1Upgrade cups-clientUpgrade cups-libs | May 20, 2018 | Mar 26, 2018 |
| Ubuntu | — | Upgrade cups | Jul 24, 2018 | Mar 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub