CVE-2010-0393
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4...
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
Exploit likelihood
What each source reports
NVD Score used
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
- Record
CVE-2010-0393- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
- Record
CVE-2010-0393- Updated
- 2026-11-02
EUVDEUVD-2010-0424 No score
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
- Record
EUVD-2010-0424- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6j26-qg9p-xqqm No score
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4...
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
- Record
GHSA-6j26-qg9p-xqqm- Updated
- 2026-11-02
OSV No score
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
- Record
CVE-2010-0393- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-0393 No score
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.
- Record
DEBIAN-CVE-2010-0393- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10075-1 No score
cups-2.1.3-2.3 on GA media
These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10075-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cupsDebian:12 |
before 1.4.2-9.1 | 1.4.2-9.1 |
cupsDebian:13 |
before 1.4.2-9.1 | 1.4.2-9.1 |
cupsDebian:14 |
before 1.4.2-9.1 | 1.4.2-9.1 |
cupsDebian:5.0 |
before 1.3.8-1+lenny8, plus listed versions 1.3.8-1+lenny61.3.8-1+lenny71.3.8-1lenny4.11.3.8-1lenny5 |
1.3.8-1+lenny8 |
cupsopenSUSE:Tumbleweed From an advisory covering 17 CVEs |
before 2.1.3-2.3 | 2.1.3-2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0393 is a medium vulnerability (CVSS 6.9) in Apple Cups, published March 3, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in cups 1.4.2-9.1.
References
cups.org/str.php?L3482
ubuntu.com/usn/USN-906-1
securityfocus.com/bid/38524
lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
mandriva.com/security/advisories?name=MDVSA-2010:072
security.gentoo.org/glsa/glsa-201207-10.xml
Show 23 moreShow less
support.apple.com/kb/HT4077
bugzilla.redhat.com/show_bug.cgi?id=558460
nvd.nist.gov/vuln/detail/CVE-2010-0393
github.com/advisories/GHSA-6j26-qg9p-xqqm
security-tracker.debian.org/tracker/CVE-2010-0393
suse.com/security/cve/CVE-2009-0163