CVE-2010-1748
- State
- Published
- Severity
- Not scored
- Published
- Jun 17, 2010
- Updated
- Aug 7, 2024
- Reserved
- May 6, 2010
Description
The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- APPLE-SA-2010-06-15-1vendor-advisory
- MDVSA-2010:234vendor-advisory
- ADV-2010-1481vdb-entry
- http://cups.org/articles.php?L596
- 40871vdb-entry
- MDVSA-2010:232vendor-advisory
- SUSE-SR:2010:023vendor-advisory
- DSA-2176vendor-advisory
- http://support.apple.com/kb/HT4188
- GLSA-201207-10vendor-advisory
- ADV-2011-0535vdb-entry
- 40220third-party-advisory
- http://cups.org/str.php?L3577
- oval:org.mitre.oval:def:9723vdb-entrysignature
- 43521third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.