CVE-2008-5183: Apple Cups

High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days.

cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.

Affected products

• Apple Cups: up to and including 1.3.9
• Apple Mac OS X: before 10.5.6 (fixed in 10.5.6)
• Apple Mac OS X Server: before 10.5.6 (fixed in 10.5.6)
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Opensuse Opensuse: version 11.0 only

Published 2008-11-21. Last modified 2026-06-16.