CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.

Emmanuel Bouillon reported a memory corruption flaw in CUPS daemon. A specially-crafted IPP request can cause daemon to crash or, possibly, execute arbitrary code.

Acknowledgements:

Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.

cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system

A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.

Accounts. A permissions issue was addressed with additional restrictions.

CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than <a href="https://access.redhat.com/security/cve/CVE-2024-47176">CVE-2024-47176</a>. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)

A buffer overflow vulnerability in the function |formatlogline| could allow remote attackers to cause a denial-of-service(DoS) on the affected system (not verified for possible arbitrary code execution). Exploitation of the vulnerability can be triggered when the configuration file |cupsd.conf| sets the value of |loglevel |to |DEBUG|.

Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.

Sauli Pahlman of CERT-FI provided us with fuzzed PDF file which causes xpdf / poppler PDF parser to crash.

The crash is caused by an attempt to dereference uninitialized Gfx::parser pointer in Gfx::getPos(), which assumes parser is either NULL or valid Parser pointer.

http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Gfx.cc?id=71063d51#n879

Description of problem: CVE-2009-3553 (bug #530111) has not been completely fixed.

Version-Release number of selected component (if applicable): Versions known to be affected:

cups-1.3.7-11.el54.5 (RHEL-5.4.z) cups-1.3.7-16.el5 (RHEL-5)

Additional info: The cause is that the cupsdDoSelect() function uses one of several implementations depending on the underlying select/poll capabilities of the operating system. For kqueue and epoll implementations, cupsdRemoveSelect() does not immediately decrease the reference count for the file descriptor and instead adds it to the cupsdinactivefds array. File descriptors in that array are finally dereferenced in cupsdStopSelect() (i.e. program termination).

In Red Hat Enterprise Linux, the epoll implementation is used.

The previous fix for CVE-2009-3553 was to check that another reference was held for the file descriptor before calling the writecb function; however, that will always be the case for both the epoll and kqueue implementations.

The correct fix is to check whether the file descriptor is in the cupsdinactivefds array before calling the writecb function.

A localhost.localdomain whitelist entry in validhost() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

Authentication Bypass vulnerability in the authorization handling of the CUPS print server. The flaw exists in the cupsdAuthorize() function (scheduler/auth.c) where, if the configured AuthType is anything other than Basic, but the request still includes an Authorization: Basic ... header, the password validation step is skipped. This allows an attacker to bypass authentication checks entirely. By exploiting this issue, an attacker can perform privileged operations, including modifying configuration files, without providing valid credentials. This vulnerability can be exploited remotely depending on the deployment configuration and does not require valid authentication.

CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.

CUPS 1.3.x and earlier ships setuid binaries which use environment variables to set the directories in which they operate.

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.

Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.

An integer overflow flaw, leading to a heap-based buffer overflow, was discovered in the Tagged Image File Format (TIFF) decoding routines used by the CUPS image-converting filters, "imagetops" and "imagetoraster". An attacker could create a malicious TIFF file that could, potentially, execute arbitrary code as the "lp" user if the file was printed.

Acknowledgements:

Red Hat would like to thank Aaron Sigel of the Apple Product Security team and iDefense for responsibly reporting this flaw.

Description of problem: rpmbuild cannot apply cups-CVE-2008-3640.patch due to the patch corruption.

Version-Release number of selected component (if applicable): cups-1.1.17-13.3.54.src.rpm cups-1.1.17-13.3.55.src.rpm

How reproducible: always

Steps to Reproduce: 1. rpm -i cups-1.1.17-13.3.54.src.rpm 2. rpmbuild -bp /usr/src/redhat/SPEC/cups.spec Actual results: error: File /usr/src/redhat/SOURCES/cups-CVE-2008-3640.patch is smaller than 4 bytes

Expected results: Unpack the sources and apply the patch.

Additional info:

Aaron Sigel of Apple Product Security reported that CUPS did not check Host: HTTP header in the connections to the daemon. This insufficient checking may be of an advantage as part of some other attack, e.g. DNS rebinding attack (however, for such attack, user's web browser or browser plugin must be prone to the DNS rebinding attack).

Upstream patch adds check for the Host: header used in clients' requests. It also introduced ServerAlias configuration directive, that must be used to allow clients to use additional valid host names besides those set has hostname or hostname's aliases.

Last updated 25 August 2025

Description of problem:

SUSE-SR:2007:014 (see URL field) reads:

- cups denial of service regression fix

CUPS packages were released to fix another denial of service problem introduced by the previous Denial of Service Fix for CVE-2007-0720, which was incomplete.

Version-Release number of selected component (if applicable):

CVE-2007-4045 Affects: RHEL4 CVE-2007-4045 Affects: RHEL5 CVE-2007-4045 Affects: FC6 CVE-2007-4045 Affects: FC7

Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function.

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.

Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.

Multiple integer overflows and one integer signedness error were found in the JBIG2 decoder. An attacker could use these flaws to cause a denial of service (application crash) via specially-crafted PDF file.

Acknowledgements:

Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting these flaws.

A security flaw was found in the JBIG2 decoder (possibility of freeing of uninitialized memory). An attacker could use this flaw to potentially cause a denial of service (application crash).

Acknowledgements:

Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting this flaw.

Null Pointer Dereference vulnerability in the ippreadio() function of the CUPS printing system. The flaw is caused by unsafe deserialization and improper validation of crafted printer attribute responses. When ippValidateAttributes() processes such responses, a null pointer dereference occurs, leading to application crash. This issue can be exploited remotely within the local subnet in default configurations, and in some cases over the network if IPP services are exposed. Exploitation requires no authentication or user interaction, allowing attackers to disrupt availability of printing services on affected systems.