apple/cups

apple/cups

Releases258

Frequency1 week 5 days

Last Release about 4 years ago

Stars2.16K

Apple CUPS Sources

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-4300 ↗	Apr 3, 2019Wednesday, 3 April 2019, 18:29	—	4.3 MEDIUM
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.
CVE-2017-18248 ↗	Mar 26, 2018Monday, 26 March 2018, 17:29	—	3.5 LOW
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
CVE-2017-18190 ↗	Feb 16, 2018Friday, 16 February 2018, 17:29	—	5 MEDIUM
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).