Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 72

Export CSV
CVE-2010-0302

cups Incomplete fix for CVE-2009-3553

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Apple Canonical Fedoraproject and 1 more
Products
Cups Mac Os X Mac Os X Server and 7 more
CVE-2010-0393

: cups possible arbitrary code execution via suid lppasswd (STR #3482)

The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Cups
CVE-2010-0542

CUPS: texttops unchecked memory allocation failure leading to NULL pointer dereference

The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed
Vendors
Apple Redhat
Products
Cups Enterprise Linux
CVE-2010-1748

cups: web interface memory disclosure

The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.

CVSS 2.0 · 4.3 Medium EPSS 6.5% KEV · Not listed
Vendors
Apple Redhat
Products
Cups Mac Os X Mac Os X Server and 1 more
CVE-2010-2431

cups: latent privilege escalation vulnerability

The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.

CVSS 2.0 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Apple Redhat
Products
Cups Enterprise Linux
CVE-2010-2432

cups: DoS (infinite loop) via HTTP_UNAUTHORIZED responses STR #3518

The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Apple
Products
Cups
CVE-2023-34241

CUPS vulnerable to use-after-free in cupsdAcceptClient()

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Macos Debian Linux Fedora and 3 more
CVE-2022-26691

cups: authorization bypass when using "local" authorization

A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Cups Mac Os X Macos and 6 more
CVE-2018-4300

cups: Session cookie generated by the CUPS web interface is easy to guess

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

CVSS 3.0 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Apple Redhat
Products
Cups Enterprise Linux
CVE-2017-18248

cups: Invalid usernames handled in scheduler/ipp.c:add_job() allow remote attackers to cause a denial of service

The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.

CVSS 3.0 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Apple
Products
Cups
CVE-2017-18190

cups: DNS rebinding attacks via incorrect whitelist

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Apple Canonical Debian and 1 more
Products
Cups Ubuntu Linux Debian Linux and 1 more
CVE-2012-6094

cups: 'Listen localhost:631' option not honoured correctly on IPv6-enabled systems when systemd used for CUPS socket activation

cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Apple Debian
Products
Cups Debian Linux