CVE-2010-0302
Description
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.
How to fix
- apple cups1.4.4 or later
- apple mac_os_x10.5.8, 10.6.4 or later
- apple mac_os_x_server10.5.8, 10.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple cups | v < 1.4.4 | 1.4.4 |
| apple mac_os_x | v < 10.5.8, 10.6.0 ≤ v < 10.6.4 | 10.5.8, 10.6.4 |
| apple mac_os_x_server | v < 10.5.8, 10.6.0 ≤ v < 10.6.4 | 10.5.8, 10.6.4 |
| fedoraproject fedora | 11 | — |
| canonical ubuntu_linux | 6.06, 8.04, 8.10, 9.04, 9.10 | — |
| redhat enterprise_linux | 5.0 | — |
| redhat enterprise_linux_desktop | 5.0 | — |
| redhat enterprise_linux_eus | 5.4 | — |
| redhat enterprise_linux_server | 5.0 | — |
| redhat enterprise_linux_workstation | 5.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.