Summary
Detail | |||
---|---|---|---|
Vendor | Apple | First view | 2002-12-26 |
Product | Cups | Last view | 2022-05-26 |
Version | 1.1.7 | Type | Application |
Update | * | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:apple:cups |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
6.7 | 2022-05-26 | CVE-2022-26691 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges. |
9.8 | 2019-12-20 | CVE-2012-6094 | cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system |
5.9 | 2019-04-03 | CVE-2018-4300 | The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10. |
5.3 | 2018-03-26 | CVE-2017-18248 | The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification. |
7.5 | 2018-02-16 | CVE-2017-18190 | A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1). |
6.8 | 2015-02-19 | CVE-2014-9679 | Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow. |
5 | 2014-07-29 | CVE-2014-5031 | The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors. |
1.9 | 2014-07-29 | CVE-2014-5030 | CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py. |
1.2 | 2014-07-23 | CVE-2014-3537 | The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/. |
4.3 | 2014-04-18 | CVE-2014-2856 | Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function. |
1.2 | 2014-01-25 | CVE-2013-6891 | lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf. |
5.1 | 2011-08-19 | CVE-2011-3170 | The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896. |
5.1 | 2011-08-19 | CVE-2011-2896 | The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895. |
7.5 | 2010-11-05 | CVE-2010-3702 | The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference. |
9.8 | 2010-11-05 | CVE-2010-2941 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request. |
5 | 2010-06-22 | CVE-2010-2432 | The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses. |
2.6 | 2010-06-22 | CVE-2010-2431 | The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file. |
6.8 | 2010-06-21 | CVE-2010-0542 | The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file. |
4.3 | 2010-06-17 | CVE-2010-1748 | The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs. |
7.5 | 2010-03-05 | CVE-2010-0302 | Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553. |
7.5 | 2009-06-09 | CVE-2009-0949 | The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags. |
6.4 | 2009-04-24 | CVE-2009-0164 | The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks. |
4.3 | 2009-04-23 | CVE-2009-1183 | The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file. |
7.5 | 2009-04-23 | CVE-2009-1182 | Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file. |
4.3 | 2009-04-23 | CVE-2009-1181 | The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
19% (8) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
14% (6) | CWE-399 | Resource Management Errors |
9% (4) | CWE-189 | Numeric Errors |
9% (4) | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
7% (3) | CWE-20 | Improper Input Validation |
4% (2) | CWE-476 | NULL Pointer Dereference |
4% (2) | CWE-416 | Use After Free |
4% (2) | CWE-264 | Permissions, Privileges, and Access Controls |
4% (2) | CWE-190 | Integer Overflow or Wraparound |
2% (1) | CWE-787 | Out-of-bounds Write |
2% (1) | CWE-697 | Insufficient Comparison |
2% (1) | CWE-290 | Authentication Bypass by Spoofing |
2% (1) | CWE-255 | Credentials Management |
2% (1) | CWE-252 | Unchecked Return Value |
2% (1) | CWE-200 | Information Exposure |
2% (1) | CWE-178 | Failure to Resolve Case Sensitivity |
2% (1) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
CAPEC : Common Attack Pattern Enumeration & Classification
id | Name |
---|---|
CAPEC-118 | Data Leakage Attacks |
CAPEC-119 | Resource Depletion |
CAPEC-125 | Resource Depletion through Flooding |
CAPEC-130 | Resource Depletion through Allocation |
CAPEC-131 | Resource Depletion through Leak |
Open Source Vulnerability Database (OSVDB)
id | Description |
---|---|
74673 | CUPS filter/image-gif.c gif_read_lzw Function Crafted LZW Stream Remote Overflow |
74539 | GIMP plug-ins/common/file-gif-load.c LZWReadByte() Function GIF File Handling... |
69064 | Poppler Gfx::getPos PDF Handling Uninitialized Pointer Dereference DoS |
68951 | CUPS IPP Request Handling Use-After-Free Arbitrary Code Execution |
65699 | CUPS auth.c cupsDoAuthentication Function HTTP_UNAUTHORIZED Response Remote DoS |
65698 | CUPS cupsFileOpen Function Multiple Temporary File Symlink Arbitrary File Ove... |
65692 | CUPS texttops.c _WriteProlog Function Memory Corruption |
65569 | CUPS Web Interface Form Variable Handling cupsd Process Memory Disclosure |
60204 | CUPS scheduler/select.c cupsdDoSelect() Function Use-after-free DoS |
58777 | CUPS SSL Negotiation Unspecified Remote DoS |
55002 | CUPS cupsd cups/ipp.c ippReadIO Function IPP Packet Handling Remote DoS |
54496 | Xpdf JBIG2 Decoder PDF File Handling Multiple Function Overflows |
54495 | CUPS JBIG2 Decoder PDF File Handling Multiple Function Overflows |
54489 | Xpdf JBIG2 Decoder PDF File Handling Unitialized Memory Free DoS |
54488 | CUPS JBIG2 Decoder PDF File Handling Unitialized Memory Free DoS |
54487 | Poppler JBIG2 Decoder PDF File Handling Out-of-bounds Read DoS |
54486 | Xpdf JBIG2 Decoder PDF File Handling Out-of-bounds Read DoS |
54485 | CUPS JBIG2 Decoder PDF File Handling Out-of-bounds Read DoS |
54484 | Poppler JBIG2 Decoder PDF File Handling NULL Dereference DoS |
54483 | Xpdf JBIG2 Decoder PDF File Handling NULL Dereference DoS |
54482 | CUPS JBIG2 Decoder PDF File Handling NULL Dereference DoS |
54481 | Poppler JBIG2 Decoder PDF File Handling Invalid Free Arbitrary Code Execution |
54480 | Xpdf JBIG2 Decoder PDF File Handling Invalid Free Arbitrary Code Execution |
54479 | CUPS JBIG2 Decoder PDF File Handling Invalid Free Arbitrary Code Execution |
54478 | Poppler JBIG2 Decoder PDF File Handling Unspecified Integer Overflow |
OpenVAS Exploits
id | Description |
---|---|
2012-10-03 | Name : Gentoo Security Advisory GLSA 201209-23 (gimp) File : nvt/glsa_201209_23.nasl |
2012-08-24 | Name : CentOS Update for tetex CESA-2012:1201 centos5 File : nvt/gb_CESA-2012_1201_tetex_centos5.nasl |
2012-08-24 | Name : RedHat Update for tetex RHSA-2012:1201-01 File : nvt/gb_RHSA-2012_1201-01_tetex.nasl |
2012-08-21 | Name : CentOS Update for gimp CESA-2012:1180 centos6 File : nvt/gb_CESA-2012_1180_gimp_centos6.nasl |
2012-08-21 | Name : CentOS Update for gimp CESA-2012:1181 centos5 File : nvt/gb_CESA-2012_1181_gimp_centos5.nasl |
2012-08-21 | Name : RedHat Update for gimp RHSA-2012:1180-01 File : nvt/gb_RHSA-2012_1180-01_gimp.nasl |
2012-08-21 | Name : RedHat Update for gimp RHSA-2012:1181-01 File : nvt/gb_RHSA-2012_1181-01_gimp.nasl |
2012-08-10 | Name : Gentoo Security Advisory GLSA 201207-10 (cups) File : nvt/glsa_201207_10.nasl |
2012-07-09 | Name : RedHat Update for cups RHSA-2011:1635-03 File : nvt/gb_RHSA-2011_1635-03_cups.nasl |
2012-04-02 | Name : Fedora Update for gimp FEDORA-2011-10761 File : nvt/gb_fedora_2011_10761_gimp_fc16.nasl |
2012-04-02 | Name : Fedora Update for cups FEDORA-2011-11173 File : nvt/gb_fedora_2011_11173_cups_fc16.nasl |
2012-04-02 | Name : Fedora Update for pl FEDORA-2011-11229 File : nvt/gb_fedora_2011_11229_pl_fc16.nasl |
2012-03-12 | Name : Debian Security Advisory DSA 2426-1 (gimp) File : nvt/deb_2426_1.nasl |
2012-02-21 | Name : RedHat Update for cups RHSA-2012:0302-03 File : nvt/gb_RHSA-2012_0302-03_cups.nasl |
2012-02-12 | Name : FreeBSD Ports: FreeBSD File : nvt/freebsd_FreeBSD14.nasl |
2012-02-11 | Name : Debian Security Advisory DSA 2354-1 (cups) File : nvt/deb_2354_1.nasl |
2011-11-18 | Name : Mandriva Update for poppler MDVSA-2011:175 (poppler) File : nvt/gb_mandriva_MDVSA_2011_175.nasl |
2011-11-08 | Name : Mandriva Update for gimp MDVSA-2011:167 (gimp) File : nvt/gb_mandriva_MDVSA_2011_167.nasl |
2011-10-21 | Name : Mandriva Update for libxfont MDVSA-2011:153 (libxfont) File : nvt/gb_mandriva_MDVSA_2011_153.nasl |
2011-10-14 | Name : Mandriva Update for cups MDVSA-2011:146 (cups) File : nvt/gb_mandriva_MDVSA_2011_146.nasl |
2011-09-23 | Name : Ubuntu Update for gimp USN-1214-1 File : nvt/gb_ubuntu_USN_1214_1.nasl |
2011-09-21 | Name : FreeBSD Ports: libXfont File : nvt/freebsd_libXfont.nasl |
2011-09-16 | Name : Ubuntu Update for cups USN-1207-1 File : nvt/gb_ubuntu_USN_1207_1.nasl |
2011-09-12 | Name : Fedora Update for cups FEDORA-2011-11221 File : nvt/gb_fedora_2011_11221_cups_fc14.nasl |
2011-09-12 | Name : Fedora Update for pl FEDORA-2011-11305 File : nvt/gb_fedora_2011_11305_pl_fc15.nasl |
Snort® IPS/IDS
Date | Description |
---|---|
2014-11-16 | Apple CUPS web interface cross site scripting attempt RuleID : 31860 - Type : SERVER-OTHER - Revision : 4 |
2014-01-10 | CUPS IPP multi-valued attribute memory corruption attempt RuleID : 26972 - Type : SERVER-OTHER - Revision : 4 |
2014-01-10 | Apple CUPS IPP memory corruption attempt RuleID : 23139 - Type : SERVER-OTHER - Revision : 5 |
2014-01-10 | Apple CUPS IPP memory corruption attempt RuleID : 23138 - Type : SERVER-OTHER - Revision : 5 |
2014-01-10 | Apple CUPS SGI image decoding buffer overflow attempt RuleID : 17663 - Type : SERVER-OTHER - Revision : 6 |
2014-01-10 | Apple CUPS Text to PostScript Filter Integer Overflow attempt RuleID : 17535 - Type : SERVER-OTHER - Revision : 11 |
2014-01-10 | Multiple vendors CUPS HPGL filter remote code execution attempt RuleID : 15189 - Type : MISC - Revision : 2 |
2014-01-10 | Multiple vendors CUPS HPGL filter remote code execution attempt RuleID : 15188 - Type : SERVER-OTHER - Revision : 8 |
2014-01-10 | Multiple vendors CUPS HPGL filter remote code execution attempt RuleID : 15187 - Type : MISC - Revision : 4 |
2014-01-10 | Multiple vendors CUPS HPGL filter remote code execution attempt RuleID : 15186 - Type : SERVER-OTHER - Revision : 7 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2018-10-26 | Name: The remote EulerOS Virtualization host is missing multiple security updates. File: EulerOS_SA-2018-1329.nasl - Type: ACT_GATHER_INFO |
2018-07-05 | Name: The remote Debian host is missing a security update. File: debian_DLA-1412.nasl - Type: ACT_GATHER_INFO |
2018-05-29 | Name: The remote Debian host is missing a security update. File: debian_DLA-1387.nasl - Type: ACT_GATHER_INFO |
2018-05-02 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2018-1079.nasl - Type: ACT_GATHER_INFO |
2018-05-02 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2018-1080.nasl - Type: ACT_GATHER_INFO |
2018-04-10 | Name: The remote Fedora host is missing a security update. File: fedora_2018-99f551e4ff.nasl - Type: ACT_GATHER_INFO |
2018-04-10 | Name: The remote Fedora host is missing a security update. File: fedora_2018-ec5f10e626.nasl - Type: ACT_GATHER_INFO |
2018-02-23 | Name: The remote Debian host is missing a security update. File: debian_DLA-1288.nasl - Type: ACT_GATHER_INFO |
2017-09-01 | Name: The remote OracleVM host is missing one or more security updates. File: oraclevm_OVMSA-2017-0147.nasl - Type: ACT_GATHER_INFO |
2016-07-18 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201607-06.nasl - Type: ACT_GATHER_INFO |
2015-07-08 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2015-559.nasl - Type: ACT_GATHER_INFO |
2015-06-19 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2015-1123.nasl - Type: ACT_GATHER_INFO |
2015-06-18 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2015-1123.nasl - Type: ACT_GATHER_INFO |
2015-06-18 | Name: The remote OracleVM host is missing one or more security updates. File: oraclevm_OVMSA-2015-0071.nasl - Type: ACT_GATHER_INFO |
2015-06-18 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2015-1123.nasl - Type: ACT_GATHER_INFO |
2015-06-18 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20150617_cups_on_SL6_x.nasl - Type: ACT_GATHER_INFO |
2015-03-30 | Name: The remote Mandriva Linux host is missing one or more security updates. File: mandriva_MDVSA-2015-108.nasl - Type: ACT_GATHER_INFO |
2015-03-26 | Name: The remote Debian host is missing a security update. File: debian_DLA-159.nasl - Type: ACT_GATHER_INFO |
2015-03-26 | Name: The remote Debian host is missing a security update. File: debian_DLA-22.nasl - Type: ACT_GATHER_INFO |
2015-03-24 | Name: The remote SuSE 11 host is missing one or more security updates. File: suse_11_cups-150302.nasl - Type: ACT_GATHER_INFO |
2015-03-19 | Name: The remote Mandriva Linux host is missing one or more security updates. File: mandriva_MDVSA-2015-049.nasl - Type: ACT_GATHER_INFO |
2015-02-27 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2015-182.nasl - Type: ACT_GATHER_INFO |
2015-02-27 | Name: The remote Ubuntu host is missing a security-related patch. File: ubuntu_USN-2520-1.nasl - Type: ACT_GATHER_INFO |
2015-02-26 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-3172.nasl - Type: ACT_GATHER_INFO |
2015-02-23 | Name: The remote Fedora host is missing a security update. File: fedora_2015-2127.nasl - Type: ACT_GATHER_INFO |