CVE-2007-5849

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-19 · updated 2026-06-16
Weakness: CWE-189

Description

Integer underflow in the asn1_get_string function in the SNMP back end (backend/snmp.c) for CUPS 1.2 through 1.3.4 allows remote attackers to execute arbitrary code via a crafted SNMP response that triggers a stack-based buffer overflow.

Affected products

Easy Software Products Cups: 1.2.4, 1.2.9, 1.2.10, 1.2.12, 1.3.3

References

http://bugs.gentoo.org/show_bug.cgi?id=201570
http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00003.html
http://secunia.com/advisories/28113
http://secunia.com/advisories/28129
http://secunia.com/advisories/28136
http://secunia.com/advisories/28200
http://secunia.com/advisories/28386
http://secunia.com/advisories/28441
http://secunia.com/advisories/28636
http://secunia.com/advisories/28676

Get alerted when CVE-2007-5849 or the next vulnerability affects your stack