CVSS: 4.3EPSS: 1%CPEs: 94EXPL: 1CVE-2010-1748 – CUPS 1.4.2 - Web Interface Information Disclosure
https://notcve.org/view.php?id=CVE-2010-1748
The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs. La función cgi_initialize_string en el archivo cgi-bin/var.c en la interfaz web en CUPS anterior a versión 1.4.4, tal y como es usado sobre Mac OS X versión 10.5.8, Mac OS X versiones 10.6 anteriores a 10.6.4, de Apple, y otras plataformas, no maneja apropiadamente los parámetros values que contienen un carácter % (porcentaje) sin dos caracteres hexadecimales posteriores, lo que permite a los atacantes dependiendo del contexto obtener información confidencial de la memoria del proceso cupsd por medio de una petición especialmente diseñada, como es demostrado por los URIs (1) /admin?OP=redirect&URL=% y (2) /admin? • https://www.exploit-db.com/exploits/34152 http://cups.org/articles.php?L596 http://cups.org/str.php?L3577 http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html http://secunia.com/advisories/40220 http://secunia.com/advisories/43521 http://security.gentoo.org/glsa/glsa-201207-10.xml http://support.apple.com/kb/HT4188 http://www.debian.org/security/2011/dsa-2176 http:/&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 7%CPEs: 16EXPL: 0CVE-2010-0302 – cups Incomplete fix for CVE-2009-3553
https://notcve.org/view.php?id=CVE-2010-0302
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553. Vulnerabilidad de uso despues de liberacion en el interfaz de gestion de descriptores de fichero en la funcion cupsdDoSelect en scheduler/select.c en the scheduler en cupsd en CUPS v1.3.7, v1.3.9, v1.3.10, y v1.4.1, cuando se utiliza kqueue o epoll, permite a atacantes remotos producir una denegacion de servicio (caida de demonio o cuelgue) a traves de la desconexion del cliente durante el listado de un gran numero de trabajos de imporesion, relacionados con el inadecuado mantenimiento del numero de referencias. NOTA: Algunos de los detalles fueron obtenidos de terceras partes. • http://cups.org/articles.php?L596 http://cups.org/str.php?L3490 http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037174.html http://secunia.com/advisories/38785 http://secunia.com/advisories/38927 http://secunia.com/advisories/38979 http://secunia.com/advisories/40220 http://security.gentoo.org/glsa/glsa-201207-10.xml http://support.apple.com/kb/HT4188 http://www.mandriva.com&# • CWE-416: Use After Free •
CVSS: 7.5EPSS: 6%CPEs: 15EXPL: 3CVE-2009-0949 – CUPS 1.3.9 - 'cups/ipp.c' Null Pointer Dereference Denial of Service
https://notcve.org/view.php?id=CVE-2009-0949
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags. La función ippReadIO en cups/ipp.c en cupsd en CUPS antes de la versión 1.3.10 no inicia de manera apropiada la memoria para paquetes de solicitud IPP, lo que permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo y caída del demonio) mediante una solicitud de programación (scheduler) con dos etiquetas IPP_TAG_UNSUPPORTED consecutivas. • https://www.exploit-db.com/exploits/33020 http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/35322 http://secunia.com/advisories/35328 http://secunia.com/advisories/35340 http://secunia.com/advisories/35342 http://secunia.com/advisories/35685 http://secunia.com/advisories/36701 http://securitytracker.com/id?1022321 http://support.apple.com/kb/HT3865 http&# • CWE-476: NULL Pointer Dereference CWE-908: Use of Uninitialized Resource •
CVSS: 6.4EPSS: 1%CPEs: 78EXPL: 0CVE-2009-0164
https://notcve.org/view.php?id=CVE-2009-0164
The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks. La interfaz web de CUPS antes de v1.3.10 no valida la cabecera HTTP Host en una solicitud de un cliente, lo que facilita para realizar ataques de revinculación de DNS a atacantes remotos. • http://bugs.gentoo.org/show_bug.cgi?id=263070 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://secunia.com/advisories/35074 http://security.gentoo.org/glsa/glsa-200904-20.xml http://support.apple.com/kb/HT3549 http://wiki.rpath.com/Advisories:rPSA-2009-0061 http://www.cups.org/articles.php?L582 http://www.cups.org/str.php?L3118 http://www.securityfocus.com/archive/1/502750/100/0/threaded http://www.securityfocus.com/bid/34665 http • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 78EXPL: 0CVE-2009-0163 – cups: Integer overflow in the TIFF image filter
https://notcve.org/view.php?id=CVE-2009-0163
Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow. El desbordamiento de enteros en las rutinas de decodificación de imágenes TIFF en CUPS versiones 1.3.9 y anteriores, permite a los atacantes remotos causar una denegación de servicio (bloqueo del demonio) y posiblemente ejecutar código arbitrario por medio de una imagen TIFF diseñada, que no es manejado apropiadamente por la función _cupsImageReadTIFF (1) en el filtro imagetops y (2) el filtro imagetoraster, lo que conduce a un desbordamiento de búfer en la región heap de la memoria. • http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html http://secunia.com/advisories/34481 http://secunia.com/advisories/34722 http://secunia.com/advisories/34747 http://secunia.com/advisories/34756 http://secunia.com/advisories/34852 http://security.gentoo.org/glsa/glsa-200904-20.xml http://wiki.rpath.com/Advisories:rPSA-2009-0061 http://www.cups.org/articles.php?L582 http://www.cups.org/str.php?L3031 http://www.debian.org/security/2009/dsa-1773 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •