CVE-2010-0302 Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll...
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple cups | < 1.4.4 | 1.4.4 |
| apple mac os x | < 10.5.8 | 10.5.8 |
| apple mac os x | >= 10.6.0, < 10.6.4 | 10.6.4 |
| apple mac os x server | < 10.5.8 | 10.5.8 |
| apple mac os x server | >= 10.6.0, < 10.6.4 | 10.6.4 |
| fedoraproject fedora | = 11 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 8.10 | No fix listed |
| Canonical Ubuntu Linux | = 9.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux eus | = 5.4 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| debian/cups(Debian:12) | < 1.4.2-10 | 1.4.2-10 |
| debian/cups(Debian:13) | < 1.4.2-10 | 1.4.2-10 |
| debian/cups(Debian:14) | < 1.4.2-10 | 1.4.2-10 |
References
- cups.org release-notes
- cups.org release-notes
- APPLE-SA-2010-06-15-1 mailing-list vendor-advisory
- FEDORA-2010-2743 mailing-list vendor-advisory
- 38785 broken-link third-party-advisory
- 38927 broken-link third-party-advisory
- 38979 broken-link third-party-advisory
- 40220 broken-link third-party-advisory
- GLSA-201207-10 third-party-advisory vendor-advisory
- support.apple.com vendor-advisory
- MDVSA-2010:073 broken-link vendor-advisory
- 38510 broken-link third-party-advisory vdb-entry
- 1024124 broken-link third-party-advisory vdb-entry
- USN-906-1 third-party-advisory vendor-advisory
- ADV-2010-1481 broken-link vdb-entry
- bugzilla.redhat.com issue-tracking patch
- oval:org.mitre.oval:def:11216 broken-link signature vdb-entry
- RHSA-2010:0129 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2010-0302 vendor-advisory
- bugs.debian.org issue-tracking