CVE-2017-18248 The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notif...
MediumCVSS 5.3
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cups(Debian:12) | < 2.2.6-1 | 2.2.6-1 |
| debian/cups(Debian:13) | < 2.2.6-1 | 2.2.6-1 |
| debian/cups(Debian:14) | < 2.2.6-1 | 2.2.6-1 |
| apple cups | < 2.2.6 | 2.2.6 |
References
- Debian Security Tracker CVE-2017-18248 vendor-advisory
- github.com patch third-party-advisory
- github.com exploit third-party-advisory
- github.com third-party-advisory
- [debian-lts-announce] 20180526 [SECURITY] [DLA 1387-1] cups security update mailing-list
- [debian-lts-announce] 20180703 [SECURITY] [DLA 1412-1] cups security update mailing-list
- security.cucumberlinux.com exploit third-party-advisory
- USN-3713-1 vendor-advisory