critical
CVE-2010-2941
cups: cupsd memory corruption vulnerability
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.3AV:A/AC:L/Au:N/C:N/I:N/A:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Oracle (high).
Description
ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | cups | 1.4.4-7 |
| debian 12 | cups | 1.4.4-7 |
| debian 13 | cups | 1.4.4-7 |
| debian 14 | cups | 1.4.4-7 |
| echo | cups | 1.4.4-7 |
| Oracle Linux 5 | cups, cups-devel, cups-libs and 1 more | 1:1.3.7-18.el5_5.8 |
| Oracle Linux 6 | cups, cups-devel, cups-libs and 2 more | 1:1.4.2-35.el6_0.1 |
| root.io debian 12 | rootio-cups | 1.4.4-7 |
| root.io debian 13 | rootio-cups | 1.4.4-7 |
Show all 16 entries from 9 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | cups | 1.4.4-7 |
| debian 12 | cups | 1.4.4-7 |
| debian 13 | cups | 1.4.4-7 |
| debian 14 | cups | 1.4.4-7 |
| echo | cups | 1.4.4-7 |
| Oracle Linux 5 | cups | 1:1.3.7-18.el5_5.8 |
| Oracle Linux 5 | cups-devel | 1:1.3.7-18.el5_5.8 |
| Oracle Linux 5 | cups-libs | 1:1.3.7-18.el5_5.8 |
| Oracle Linux 5 | cups-lpd | 1:1.3.7-18.el5_5.8 |
| Oracle Linux 6 | cups | 1:1.4.2-35.el6_0.1 |
| Oracle Linux 6 | cups-devel | 1:1.4.2-35.el6_0.1 |
| Oracle Linux 6 | cups-libs | 1:1.4.2-35.el6_0.1 |
| Oracle Linux 6 | cups-lpd | 1:1.4.2-35.el6_0.1 |
| Oracle Linux 6 | cups-php | 1:1.4.2-35.el6_0.1 |
| root.io debian 12 | rootio-cups | 1.4.4-7 |
| root.io debian 13 | rootio-cups | 1.4.4-7 |
References
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050977.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051277.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051301.html
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
- http://rhn.redhat.com/errata/RHSA-2010-0811.html
- http://secunia.com/advisories/42287
All 34 references
- http://secunia.com/advisories/42867
- http://secunia.com/advisories/43521
- http://security.gentoo.org/glsa/glsa-201207-10.xml
- http://securitytracker.com/id?1024662
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.468323
- http://support.apple.com/kb/HT4435
- http://www.debian.org/security/2011/dsa-2176
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:232
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:233
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:234
- http://www.osvdb.org/68951
- http://www.redhat.com/support/errata/RHSA-2010-0866.html
- http://www.securityfocus.com/bid/44530
- http://www.ubuntu.com/usn/USN-1012-1
- http://www.vupen.com/english/advisories/2010/2856
- http://www.vupen.com/english/advisories/2010/3042
- http://www.vupen.com/english/advisories/2010/3088
- http://www.vupen.com/english/advisories/2011/0061
- http://www.vupen.com/english/advisories/2011/0535
- https://access.redhat.com/security/cve/CVE-2010-2941
- https://bugzilla.redhat.com/show_bug.cgi?id=624438
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62882
- https://linux.oracle.com/cve/CVE-2010-2941.html
- https://linux.oracle.com/errata/ELSA-2010-0866.html
- https://nvd.nist.gov/vuln/detail/CVE-2010-2941
- https://www.cve.org/CVERecord?id=CVE-2010-2941