CVSS: 3.2EPSS: 0%CPEs: 84EXPL: 0CVE-2010-2431 – cups: latent privilege escalation vulnerability
https://notcve.org/view.php?id=CVE-2010-2431
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file. La función cupsFileOpen en CUPS en versiones anteriores a la 1.4.4 permite a usuarios locales que pertenezcan al grupo lp, sobreescribir ficheros de su elección mediante un ataque de enlace simbólico en el fichero (1) /var/cache/cups/remote.cache o (2) /var/cache/cups/job.cache. • http://cups.org/articles.php?L596 http://cups.org/str.php?L3510 http://rhn.redhat.com/errata/RHSA-2010-0811.html http://secunia.com/advisories/43521 http://security.gentoo.org/glsa/glsa-201207-10.xml http://www.debian.org/security/2011/dsa-2176 http://www.mandriva.com/security/advisories?name=MDVSA-2010:232 http://www.mandriva.com/security/advisories?name=MDVSA-2010:234 http://www.vupen.com/english/advisories/2010/2856 http://www.vupen.com/english/advisories/2011&#x • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.8EPSS: 1%CPEs: 84EXPL: 0CVE-2010-0542 – CUPS: texttops unchecked memory allocation failure leading to NULL pointer dereference
https://notcve.org/view.php?id=CVE-2010-0542
The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file. La función _WriteProlog de texttops.c en texttops en el subsistema Text Filter de CUPS en versiones anteriores a la v1.4.4 no chequea los valores devueltos de ciertas llamadas calloc, lo que permite a atacantes remotos provocar una denegación de servicio (dereferenciación de puntero nulo o corrupción de la memoria dinámica) o posiblemente ejecutar código de su elección a través de un fichero modificado. • http://cups.org/articles.php?L596 http://cups.org/str.php?L3516 http://cups.org/strfiles/3516/str3516.patch http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html http://secunia.com/advisories/43521 http://security.gentoo.org/glsa/glsa-201207-10.xml http://securitytracker.com/id?1024121 http://www.debian.org/security/2011/dsa-2176 http://www.mandriva.com/security/advisories?name=MDVSA-2010:232 http://www.mandriva.com/security/advisories? • CWE-264: Permissions, Privileges, and Access Controls CWE-476: NULL Pointer Dereference •
CVSS: 4.3EPSS: 1%CPEs: 94EXPL: 1CVE-2010-1748 – CUPS 1.4.2 - Web Interface Information Disclosure
https://notcve.org/view.php?id=CVE-2010-1748
The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs. La función cgi_initialize_string en el archivo cgi-bin/var.c en la interfaz web en CUPS anterior a versión 1.4.4, tal y como es usado sobre Mac OS X versión 10.5.8, Mac OS X versiones 10.6 anteriores a 10.6.4, de Apple, y otras plataformas, no maneja apropiadamente los parámetros values que contienen un carácter % (porcentaje) sin dos caracteres hexadecimales posteriores, lo que permite a los atacantes dependiendo del contexto obtener información confidencial de la memoria del proceso cupsd por medio de una petición especialmente diseñada, como es demostrado por los URIs (1) /admin?OP=redirect&URL=% y (2) /admin? • https://www.exploit-db.com/exploits/34152 http://cups.org/articles.php?L596 http://cups.org/str.php?L3577 http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html http://secunia.com/advisories/40220 http://secunia.com/advisories/43521 http://security.gentoo.org/glsa/glsa-201207-10.xml http://support.apple.com/kb/HT4188 http://www.debian.org/security/2011/dsa-2176 http:/&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 7%CPEs: 16EXPL: 0CVE-2010-0302 – cups Incomplete fix for CVE-2009-3553
https://notcve.org/view.php?id=CVE-2010-0302
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553. Vulnerabilidad de uso despues de liberacion en el interfaz de gestion de descriptores de fichero en la funcion cupsdDoSelect en scheduler/select.c en the scheduler en cupsd en CUPS v1.3.7, v1.3.9, v1.3.10, y v1.4.1, cuando se utiliza kqueue o epoll, permite a atacantes remotos producir una denegacion de servicio (caida de demonio o cuelgue) a traves de la desconexion del cliente durante el listado de un gran numero de trabajos de imporesion, relacionados con el inadecuado mantenimiento del numero de referencias. NOTA: Algunos de los detalles fueron obtenidos de terceras partes. • http://cups.org/articles.php?L596 http://cups.org/str.php?L3490 http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037174.html http://secunia.com/advisories/38785 http://secunia.com/advisories/38927 http://secunia.com/advisories/38979 http://secunia.com/advisories/40220 http://security.gentoo.org/glsa/glsa-201207-10.xml http://support.apple.com/kb/HT4188 http://www.mandriva.com&# • CWE-416: Use After Free •
CVSS: 6.9EPSS: 0%CPEs: 4EXPL: 0CVE-2010-0393
https://notcve.org/view.php?id=CVE-2010-0393
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers. La funcion _cupsGetlang, tal y como se utiliza en lppasswd.c en lppasswd en CUPS v1.2.2, v1.3.7, v1.3.9, y v1.4.1, cuenta con una situacion variable para determinar el fichero que provee cadenas de localizacion de un mensaje, lo que permite a usuarios locales ganar privilegios a traves de un fichero que contiene datos de localizacion manipulados con ciertos formatos de cadena. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://security.gentoo.org/glsa/glsa-201207-10.xml http://support.apple.com/kb/HT4077 http://www.cups.org/str.php?L3482 http://www.mandriva.com/security/advisories?name=MDVSA-2010:072 http://www.mandriva.com/security/advisories?name=MDVSA-2010:073 http://www.securityfocus.com/bid/38524 http://www.ubuntu.com/usn/USN-906-1 https://bugzilla.redhat.com/show_bug.cgi?id=558460 • CWE-264: Permissions, Privileges, and Access Controls •