← Vulnerability feed

Vulnerability record · CVE-2010-1748 · published 17 June 2010

CVE-2010-1748: Apple cups memory buffer overflow vulnerability

Apple · Cups

The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.

4.3 CVSS 2.0 Medium EPSS 6.5% · top 6.5% CWE-119 · Memory buffer overflow
4.3CVSS 2.0 base score
6.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
30References
16 Jun 2026Last modified by NVD

Description

The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.

AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://cups.org/articles.php?L596
http://cups.org/str.php?L3577
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
http://secunia.com/advisories/40220 Vendor Advisory
http://secunia.com/advisories/43521 Vendor Advisory
http://security.gentoo.org/glsa/glsa-201207-10.xml
http://support.apple.com/kb/HT4188 PatchVendor Advisory
http://www.debian.org/security/2011/dsa-2176
http://www.mandriva.com/security/advisories?name=MDVSA-2010:232
http://www.mandriva.com/security/advisories?name=MDVSA-2010:234
http://www.securityfocus.com/bid/40871 Patch
http://www.vupen.com/english/advisories/2010/1481 Vendor Advisory
http://www.vupen.com/english/advisories/2011/0535 Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9723
http://cups.org/articles.php?L596
http://cups.org/str.php?L3577
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
http://secunia.com/advisories/40220 Vendor Advisory
http://secunia.com/advisories/43521 Vendor Advisory
http://security.gentoo.org/glsa/glsa-201207-10.xml
http://support.apple.com/kb/HT4188 PatchVendor Advisory
http://www.debian.org/security/2011/dsa-2176
http://www.mandriva.com/security/advisories?name=MDVSA-2010:232
http://www.mandriva.com/security/advisories?name=MDVSA-2010:234
http://www.securityfocus.com/bid/40871 Patch
http://www.vupen.com/english/advisories/2010/1481 Vendor Advisory
http://www.vupen.com/english/advisories/2011/0535 Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9723

Track CVE-2010-1748 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5184Apple cups vulnerabilityThe web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easie…EPSS 3.7%10.0CVE-2008-3641Apple cups vulnerabilityThe Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and …EPSS 24%10.0CVE-2008-0053Apple cups memory buffer overflow vulnerabilityMultiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a craft…EPSS 8.3%9.8CVE-2012-6094Apple cups incorrect authorization vulnerabilitycups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the systemEPSS 2.1%9.8CVE-2010-2941Apple cups use after free vulnerabilityipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote a…EPSS 6.4%9.8CVE-2004-2154Apple cups vulnerabilityCUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name …EPSS 2.1%7.5CVE-2017-18190Apple cups authentication bypass by spoofing vulnerabilityA localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP c…EPSS 2.9%7.5CVE-2010-3702Apple cups null pointer dereference vulnerabilityThe Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and pos…EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2010-1748), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.