CVE-2004-2154: Apple Cups

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.

Affected products

• Apple Cups: before 1.1.21 (fixed in 1.1.21); version 1.1.21 only
• Canonical Ubuntu Linux: version 4.10 only

Published 2004-12-31. Last modified 2026-06-16.