CVE-2010-2941

Published: Nov 5, 2010Modified: Apr 29, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.

Affected (26)

Products: Apple: Cups, Mac Os X, Mac Os X Server · Fedoraproject: Fedora · Canonical: Ubuntu Linux · +4 more

Show all products

3 products

1 product

1 product

1 product

1 product

2 products

Linux Enterprise Server

Redhat

4 products

Enterprise Linux

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apple Cups	Up to 1.4.4
Apple Mac Os X	Before 10.5.8
Apple Mac Os X	From 10.6.0 to 10.6.4
Apple Mac Os X Server	Before 10.5.8
Apple Mac Os X Server	From 10.6.0 to 10.6.4

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 12
Fedoraproject Fedora	Version 13
Fedoraproject Fedora	Version 14

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.10

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0

Configuration E

7 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3
Suse Linux Enterprise	Version 10.0 sp3
Suse Linux Enterprise	Version 11.0
Suse Linux Enterprise	Version 11.0 sp1
Suse Linux Enterprise Server	Version 9

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Workstation	Version 5.0

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (58)

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox

Source: secalert@redhat.com

Broken Link

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050977.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051277.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051301.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html

Source: secalert@redhat.com

Mailing List

http://rhn.redhat.com/errata/RHSA-2010-0811.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/42287

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/42867

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/43521

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-201207-10.xml

Source: secalert@redhat.com

Third Party Advisory

http://securitytracker.com/id?1024662

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.468323

Source: secalert@redhat.com

Broken Link

http://support.apple.com/kb/HT4435

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2011/dsa-2176

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2010:232

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:233

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:234

Source: secalert@redhat.com

Broken Link

http://www.osvdb.org/68951

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2010-0866.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/44530

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1012-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2856

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3042

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2010/3088

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0061

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0535

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=624438

Source: secalert@redhat.com

Issue TrackingPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/62882

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox