CVE-2008-5183

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-11-21 · updated 2026-06-16
Weakness: CWE-476

Description

cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.

Affected products

cups: through 1.3.9
macOS: before 10.5.6 — fixed in 10.5.6
Apple Mac Os X Server: before 10.5.6 — fixed in 10.5.6
Debian Linux: 5.0, 6.0
Opensuse: 11.0

How to fix

Upgrade to a fixed version: macOS 10.5.6; Apple Mac Os X Server 10.5.6. Check the vendor advisory for mitigations.

References

http://lab.gnucitizen.org/projects/cups-0day
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://secunia.com/advisories/33937
http://secunia.com/advisories/43521
http://support.apple.com/kb/HT3438
http://www.debian.org/security/2011/dsa-2176
http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
http://www.openwall.com/lists/oss-security/2008/11/19/3
http://www.openwall.com/lists/oss-security/2008/11/19/4
http://www.openwall.com/lists/oss-security/2008/11/20/1

Get alerted when CVE-2008-5183 or the next vulnerability affects your stack