CVE-2009-0163

Published: Apr 23, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.

Affected (78)

Products: Apple: Cups

1 product

Configuration A

78 vulnerable

Vulnerable Software	Affected Versions
Apple Cups	Up to 1.3.9
Apple Cups	Version 1.1.10-1
Apple Cups	Version 1.1.10
Apple Cups	Version 1.1.11
Apple Cups	Version 1.1.12
Apple Cups	Version 1.1.13
Apple Cups	Version 1.1.14
Apple Cups	Version 1.1.15
Apple Cups	Version 1.1.16
Apple Cups	Version 1.1.17
Apple Cups	Version 1.1.18
Apple Cups	Version 1.1.19
Apple Cups	Version 1.1.19 rc1
Apple Cups	Version 1.1.19 rc2
Apple Cups	Version 1.1.19 rc3
Apple Cups	Version 1.1.19 rc4
Apple Cups	Version 1.1.19 rc5
Apple Cups	Version 1.1.1
Apple Cups	Version 1.1.20
Apple Cups	Version 1.1.20 rc1
Apple Cups	Version 1.1.20 rc2
Apple Cups	Version 1.1.20 rc3
Apple Cups	Version 1.1.20 rc4
Apple Cups	Version 1.1.20 rc5
Apple Cups	Version 1.1.20 rc6
Apple Cups	Version 1.1.21
Apple Cups	Version 1.1.21 rc1
Apple Cups	Version 1.1.21 rc2
Apple Cups	Version 1.1.22
Apple Cups	Version 1.1.22 rc1
Apple Cups	Version 1.1.22 rc2
Apple Cups	Version 1.1.23
Apple Cups	Version 1.1.23 rc1
Apple Cups	Version 1.1.2
Apple Cups	Version 1.1.3
Apple Cups	Version 1.1.4
Apple Cups	Version 1.1.5-1
Apple Cups	Version 1.1.5-2
Apple Cups	Version 1.1.5
Apple Cups	Version 1.1.6-1
Apple Cups	Version 1.1.6-2
Apple Cups	Version 1.1.6-3
Apple Cups	Version 1.1.6
Apple Cups	Version 1.1.7
Apple Cups	Version 1.1.8
Apple Cups	Version 1.1.9-1
Apple Cups	Version 1.1.9
Apple Cups	Version 1.1
Apple Cups	Version 1.2.0
Apple Cups	Version 1.2.10
Apple Cups	Version 1.2.11
Apple Cups	Version 1.2.12
Apple Cups	Version 1.2.1
Apple Cups	Version 1.2.2
Apple Cups	Version 1.2.3
Apple Cups	Version 1.2.4
Apple Cups	Version 1.2.5
Apple Cups	Version 1.2.6
Apple Cups	Version 1.2.7
Apple Cups	Version 1.2.8
Apple Cups	Version 1.2.9
Apple Cups	Version 1.2 b1
Apple Cups	Version 1.2 b2
Apple Cups	Version 1.2 rc1
Apple Cups	Version 1.2 rc2
Apple Cups	Version 1.2 rc3
Apple Cups	Version 1.3.0
Apple Cups	Version 1.3.1
Apple Cups	Version 1.3.2
Apple Cups	Version 1.3.3
Apple Cups	Version 1.3.4
Apple Cups	Version 1.3.5
Apple Cups	Version 1.3.6
Apple Cups	Version 1.3.7
Apple Cups	Version 1.3.8
Apple Cups	Version 1.3 b1
Apple Cups	Version 1.3 rc1
Apple Cups	Version 1.3 rc2

Related CWEs

References (38)

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html

Source: cve@mitre.org

http://secunia.com/advisories/34481

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/34722

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/34747

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/34756

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/34852

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200904-20.xml

Source: cve@mitre.org

http://wiki.rpath.com/Advisories:rPSA-2009-0061

Source: cve@mitre.org

http://www.cups.org/articles.php?L582

Source: cve@mitre.org

http://www.cups.org/str.php?L3031

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1773

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0428.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0429.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502750/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/34571

Source: cve@mitre.org

http://www.securitytracker.com/id?1022070

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-760-1

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=490596

Source: cve@mitre.org

Patch

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11546

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34481

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/34722

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/34747

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/34756

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/34852

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200904-20.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://wiki.rpath.com/Advisories:rPSA-2009-0061

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.cups.org/articles.php?L582

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.cups.org/str.php?L3031

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1773

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0428.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0429.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/502750/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/34571

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1022070

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/usn-760-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=490596

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11546

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.