CVE-2008-3639: Buffer Overflow

Q: What is the severity of CVE-2008-3639?

CVE-2008-3639 is classified as a critical vulnerability due to its potential to allow remote code execution.

Q: How do I fix CVE-2008-3639?

To fix CVE-2008-3639, upgrade CUPS to version 1.3.9 or later, as it contains the necessary patches.

Q: What versions of CUPS are affected by CVE-2008-3639?

CVE-2008-3639 affects CUPS versions prior to 1.3.9 and several earlier versions including 1.1 and versions up to 1.3.8.

Q: What is the exploit method for CVE-2008-3639?

The vulnerability can be exploited through specially crafted SGI images with malformed Run Length Encoded data.

Q: Who is vulnerable to CVE-2008-3639?

Any system running the affected versions of CUPS prior to 1.3.9 is at risk of CVE-2008-3639.

Published Oct 14, 2008

Updated

Heap-based buffer overflow in the readrle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded (RLE) data containing a small image and a large row count.

Affected Software

77 affected components

apple CUPS=1.1.20

apple CUPS=1.1.5-2

apple CUPS=1.1.14

apple CUPS=1.3-rc2

apple CUPS=1.1.6-1

apple CUPS=1.1.18

apple CUPS=1.1.12

apple CUPS=1.1.5-1

apple CUPS=1.3.3

apple CUPS=1.1.22

apple CUPS=1.2.0

apple CUPS=1.1.16

apple CUPS=1.3.1

apple CUPS=1.1.23-rc1

apple CUPS=1.1.20-rc1

apple CUPS=1.1.15

apple CUPS=1.1.17

apple CUPS=1.1.20-rc6

apple CUPS=1.2.4

apple CUPS=1.1.19-rc1

apple CUPS=1.3.2

apple CUPS=1.1.22-rc1

apple CUPS=1.1.7

apple CUPS=1.2-rc2

apple CUPS=1.1.6-2

apple CUPS=1.3-b1

apple CUPS=1.1.3

apple CUPS=1.2.3

apple CUPS=1.1.21

apple CUPS=1.2.9

apple CUPS=1.2.10

apple CUPS=1.1.4

apple CUPS=1.1.23

apple CUPS=1.2.6

apple CUPS=1.2-b1

apple CUPS=1.1.20-rc4

apple CUPS=1.1.19

apple CUPS=1.1

apple CUPS=1.3.4

apple CUPS=1.1.8

apple CUPS<=1.3.8

apple CUPS=1.1.5

apple CUPS=1.2.1

apple CUPS=1.2-rc3

apple CUPS=1.1.2

apple CUPS=1.1.13

apple CUPS=1.1.19-rc4

apple CUPS=1.1.9-1

apple CUPS=1.2.12

apple CUPS=1.1.21-rc2

apple CUPS=1.2-b2

apple CUPS=1.2.7

apple CUPS=1.1.6-3

apple CUPS=1.1.20-rc5

apple CUPS=1.1.9

apple CUPS=1.3.7

apple CUPS=1.1.19-rc5

apple CUPS=1.2-rc1

apple CUPS=1.1.1

apple CUPS=1.2.8

apple CUPS=1.2.2

apple CUPS=1.1.10

apple CUPS=1.2.11

apple CUPS=1.1.22-rc2

apple CUPS=1.1.21-rc1

apple CUPS=1.3-rc1

apple CUPS=1.1.11

apple CUPS=1.1.19-rc3

apple CUPS=1.1.6

apple CUPS=1.1.10-1

apple CUPS=1.3.0

apple CUPS=1.3.5

apple CUPS=1.3.6

apple CUPS=1.1.20-rc2

apple CUPS=1.1.20-rc3

apple CUPS=1.2.5

apple CUPS=1.1.19-rc2

Event History

Oct 14, 2008

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3639?

CVE-2008-3639 is classified as a critical vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2008-3639?

To fix CVE-2008-3639, upgrade CUPS to version 1.3.9 or later, as it contains the necessary patches.

What versions of CUPS are affected by CVE-2008-3639?