The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
The product uses or accesses a resource that has not been initialized.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cups | Apple | * | 1.3.10 (excluding) |
| Red Hat Enterprise Linux 3 | RedHat | cups-1:1.1.17-13.3.62 | * |
| Red Hat Enterprise Linux 4 | RedHat | cups-1:1.1.22-0.rc1.9.32.el4_8.3 | * |
| Red Hat Enterprise Linux 5 | RedHat | cups-1:1.3.7-8.el5_3.6 | * |
| Cups | Ubuntu | intrepid | * |
| Cups | Ubuntu | jaunty | * |
| Cups | Ubuntu | upstream | * |
| Cupsys | Ubuntu | dapper | * |
| Cupsys | Ubuntu | hardy | * |