CVE-2009-3553

Published: Nov 20, 2009Modified: Apr 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.

Affected (14)

Products: Apple: Cups, Mac Os X, Mac Os X Server · Fedoraproject: Fedora · Canonical: Ubuntu Linux · +2 more

Show all products

Apple: Cups, Mac Os X, Mac Os X Server · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Enterprise Linux

3 products

1 product

1 product

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apple Cups	Version 1.3.10
Apple Cups	Version 1.3.7
Apple Mac Os X	Before 10.5.8
Apple Mac Os X	From 10.6.0 to 10.6.2
Apple Mac Os X Server	Before 10.5.8
Apple Mac Os X Server	From 10.6.0 to 10.6.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 10

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5.0

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (44)

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html

Source: secalert@redhat.com

Mailing List

http://secunia.com/advisories/37360

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/37364

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/38241

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/43521

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-201207-10.xml

Source: secalert@redhat.com

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-66-275230-1

Source: secalert@redhat.com

Broken Link

http://support.apple.com/kb/HT4004

Source: secalert@redhat.com

Vendor Advisory

http://www.cups.org/newsgroups.php/newsgroups.php?v5994+gcups.bugs

Source: secalert@redhat.com

Broken LinkPatchVendor Advisory

http://www.cups.org/newsgroups.php/newsgroups.php?v5996+gcups.bugs

Source: secalert@redhat.com

Broken LinkPatchVendor Advisory

http://www.cups.org/newsgroups.php/newsgroups.php?v6055+gcups.bugs

Source: secalert@redhat.com

Broken LinkPatchVendor Advisory

http://www.cups.org/str.php?L3200

Source: secalert@redhat.com

Broken LinkPatchVendor Advisory

http://www.debian.org/security/2011/dsa-2176

Source: secalert@redhat.com

Mailing List

http://www.mandriva.com/security/advisories?name=MDVSA-2010:073

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2009-1595.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/37048

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-906-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0173

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0535

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=530111

Source: secalert@redhat.com

Issue Tracking

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11183

Source: secalert@redhat.com

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00332.html

Source: secalert@redhat.com

Mailing List

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html