CVEvulnerability

CVE-2009-0949

7.5 HIGH Published 2009-06-09 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-06-09
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-908

Description

The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.

Affected configurations

• apple cups (< 1.3.10) • canonical ubuntu linux 6.06 • canonical ubuntu linux 8.04 • canonical ubuntu linux 8.10 • canonical ubuntu linux 9.04 • debian debian linux 4.0 • debian debian linux 5.0 • debian debian linux 6.0 • apple mac os x (>= 10.0.0 < 10.4.11) • apple mac os x (>= 10.5.0 < 10.5.8) • apple mac os x server (>= 10.0.0 < 10.4.11) • apple mac os x server (>= 10.5.0 < 10.5.8) • opensuse opensuse 10.3 • suse linux enterprise 9.0 • suse linux enterprise 10.0

Related

Weakness · CWE (1)

  • CWE-908 Use of Uninitialized Resource weakness

Referenced by CWE · observed example (3)

  • CWE-476 NULL Pointer Dereference weakness
  • CWE-665 Improper Initialization weakness
  • CWE-908 Use of Uninitialized Resource weakness

References