Description
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.4.2-10 | — |
| Debian 13 | cups | 1.4.2-10 | — |
| Debian 12 | cups | 1.4.2-10 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cups +3 | 1:1.3.7-11.el5_4.6 | RHSA-2010:0129 |
Advisories 1
- RHSA-2010:0129 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- APPLE-SA-2010-06-15-1 vendor-advisory
- USN-906-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=557775
- oval:org.mitre.oval:def:11216 vdb-entry signature
- ADV-2010-1481 vdb-entry
- http://cups.org/articles.php?L596
- 1024124 vdb-entry
- http://support.apple.com/kb/HT4188
- GLSA-201207-10 vendor-advisory
- FEDORA-2010-2743 vendor-advisory
- 40220 third-party-advisory
- MDVSA-2010:073 vendor-advisory
- http://cups.org/str.php?L3490
- 38510 vdb-entry
- 38785 third-party-advisory
- RHSA-2010:0129 vendor-advisory
- 38979 third-party-advisory
- 38927 third-party-advisory