CVE-2010-0393

CUPS 1.2.2, 1.3.7, 1.3.9, 1.4.1 - Local Privilege Escalation via Localized Message File Format String Injection

Title source: llm

Description

The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.

References (9)

Core 9

Core References

Various Sources x_refsource_misc

http://www.cups.org/str.php?L3482

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-906-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/38524

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2010:072

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-201207-10.xml

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2010:073

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT4077

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=558460

Scores

EPSS 0.0032

EPSS Percentile 24.4%

Details

CWE

CWE-264

Status published

Products (4)

apple/cups 1.2.2

apple/cups 1.3.7

apple/cups 1.3.9

apple/cups 1.4.1

Published Mar 05, 2010

Tracked Since Feb 18, 2026