CVE-2010-2941 ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-fr...
CriticalCVSS 9.8
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple cups | <= 1.4.4 | No fix listed |
| apple mac os x | < 10.5.8 | 10.5.8 |
| apple mac os x | >= 10.6.0, <= 10.6.4 | No fix listed |
| apple mac os x server | < 10.5.8 | 10.5.8 |
| apple mac os x server | >= 10.6.0, <= 10.6.4 | No fix listed |
| fedoraproject fedora | = 12 | No fix listed |
| fedoraproject fedora | = 13 | No fix listed |
| fedoraproject fedora | = 14 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| opensuse | = 11.1 | No fix listed |
| opensuse | = 11.2 | No fix listed |
| opensuse | = 11.3 | No fix listed |
| SUSE linux enterprise | = 10.0-sp3 | No fix listed |
| SUSE linux enterprise | = 11.0 | No fix listed |
| SUSE linux enterprise | = 11.0-sp1 | No fix listed |
| SUSE linux enterprise server | = 9 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| debian/cups(Debian:12) | < 1.4.4-7 | 1.4.4-7 |
| debian/cups(Debian:13) | < 1.4.4-7 | 1.4.4-7 |
| debian/cups(Debian:14) | < 1.4.4-7 | 1.4.4-7 |
References
- blogs.sun.com broken-link
- APPLE-SA-2010-11-10-1 mailing-list vendor-advisory
- FEDORA-2010-17641 mailing-list vendor-advisory
- FEDORA-2010-17627 mailing-list vendor-advisory
- FEDORA-2010-17615 mailing-list vendor-advisory
- SUSE-SR:2010:023 mailing-list vendor-advisory
- RHSA-2010:0811 third-party-advisory vendor-advisory
- 42287 broken-link third-party-advisory
- 42867 broken-link third-party-advisory
- 43521 broken-link third-party-advisory
- GLSA-201207-10 third-party-advisory vendor-advisory
- 1024662 broken-link third-party-advisory vdb-entry
- SSA:2010-333-01 broken-link vendor-advisory
- support.apple.com broken-link
- DSA-2176 mailing-list third-party-advisory vendor-advisory
- MDVSA-2010:232 broken-link vendor-advisory
- MDVSA-2010:233 broken-link vendor-advisory
- MDVSA-2010:234 broken-link vendor-advisory
- 68951 broken-link vdb-entry
- RHSA-2010:0866 broken-link vendor-advisory
- 44530 broken-link third-party-advisory vdb-entry
- USN-1012-1 third-party-advisory vendor-advisory
- ADV-2010-2856 broken-link vdb-entry vendor-advisory
- ADV-2010-3042 broken-link vdb-entry
- ADV-2010-3088 broken-link vdb-entry
- ADV-2011-0061 broken-link vdb-entry
- ADV-2011-0535 broken-link vdb-entry
- bugzilla.redhat.com issue-tracking patch
- cups-cupsd-code-execution(62882) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2010-2941 vendor-advisory
- bugs.debian.org issue-tracking