CVEvulnerability
CVE-2010-0393
6.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-03-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
Affected configurations
• apple cups 1.2.2
• apple cups 1.3.7
• apple cups 1.3.9
• apple cups 1.4.1
Related
Weakness · not in database (1)
References
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html lists.apple.com
- http://security.gentoo.org/glsa/glsa-201207-10.xml security.gentoo.org
- http://support.apple.com/kb/HT4077 support.apple.com
- http://www.cups.org/str.php?L3482 www.cups.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:072 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:073 www.mandriva.com
- http://www.securityfocus.com/bid/38524 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-906-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=558460 bugzilla.redhat.com
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html lists.apple.com
- http://security.gentoo.org/glsa/glsa-201207-10.xml security.gentoo.org
- http://support.apple.com/kb/HT4077 support.apple.com
- http://www.cups.org/str.php?L3482 www.cups.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:072 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:073 www.mandriva.com
- http://www.securityfocus.com/bid/38524 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-906-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=558460 bugzilla.redhat.com