CVE-2010-2941: Apple Cups

Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days.

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.

Affected products

• Apple Cups: up to and including 1.4.4
• Apple Mac OS X: before 10.5.8 (fixed in 10.5.8); from 10.6.0, up to and including 10.6.4
• Apple Mac OS X Server: before 10.5.8 (fixed in 10.5.8); from 10.6.0, up to and including 10.6.4
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 9.10 only; version 10.04 only; version 10.10 only
• Debian Debian Linux: version 5.0 only
• Fedoraproject Fedora: version 12 only; version 13 only; version 14 only
• Opensuse Opensuse: version 11.1 only; version 11.2 only; version 11.3 only
• Red Hat Enterprise Linux: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Desktop: version 5.0 only
• Red Hat Enterprise Linux Server: version 5.0 only
• Red Hat Enterprise Linux Workstation: version 5.0 only
• Suse Linux Enterprise: version 10.0 only; version 11.0 only
• Suse Linux Enterprise Server: version 9 only

Published 2010-11-05. Last modified 2026-06-16.