CVE-2008-0882
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote...
CVE-2008-0882 is a high vulnerability (CVSS 10.0) in Cups, published February 21, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.79%, the 93rd percentile. Fixed in cups 1.3.6-1.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 5.79%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.6-1cups +16 more
Description
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cupsDebian:12 | before 1.3.6-1 | 1.3.6-1 |
cupsDebian:13 | before 1.3.6-1 | 1.3.6-1 |
cupsDebian:14 | before 1.3.6-1 | 1.3.6-1 |
cupsysDebian:4.0 From an advisory covering 2 CVEs | before 1.2.7-4etch3, plus listed versions 1.2.7-41.2.7-4etch11.2.7-4etch2 | 1.2.7-4etch3 |
cupsysDebian:5.0 | before 1.3.5-1+lenny1, plus listed versions 1.0.4-121.0.4-12.21.1.14-5woody101.1.14-5woody121.1.14-5woody13 Show 45 moreShow less1.1.14-5woody141.1.20final+rc1-81.1.23-101.1.23-10sarge11.1.23-111.1.23-121.1.23-131.1.23-141.1.23-151.1.23-41.1.23-51.1.23-71.1.23-81.1.23-91.1.99.b1-21.1.99.b1.r4748-11.1.99.b1.r4748-21.1.99.b1.r4748-31.1.99.b1.r4748-41.1.99.b1.r4841-11.1.99.b1.r4876-11.1.99.b1.r4885-11.1.99.rc2-0exp11.2.1-0exp11.2.1-11.2.1-21.2.1-2bpo11.2.1-31.2.1-41.2.11-11.2.11-21.2.11-31.2.12-11.2.12-21.2.12-31.2.12-41.2.2-11.2.2-21.2.3-11.2.4-11.2.4-21.2.5-11.2.6-11.2.6-21.2.7-1 | 1.3.5-1+lenny1 |
cupsRed Hat:enterprise_linux:5::client_workstation | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-develRed Hat:enterprise_linux:5::client_workstation | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cupsRed Hat:enterprise_linux:5::client | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-debuginfoRed Hat:enterprise_linux:5::client | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cups-libsRed Hat:enterprise_linux:5::client | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-lpdRed Hat:enterprise_linux:5::client | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cupsRed Hat:enterprise_linux:5::server | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-debuginfoRed Hat:enterprise_linux:5::server | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-develRed Hat:enterprise_linux:5::server | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-libsRed Hat:enterprise_linux:5::server | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
cups-lpdRed Hat:enterprise_linux:5::server | before 1:1.2.4-11.14.el5_1.4 | 1:1.2.4-11.14.el5_1.4 |
What each source reports
NVD Score used
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
- Record
CVE-2008-0882- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
- Record
CVE-2008-0882- Updated
- 2026-11-02
EUVDEUVD-2008-0889No score
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2008-0889- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcjx-xf8c-qxqmNo score
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote...
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
- Record
GHSA-vcjx-xf8c-qxqm- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
- Record
CVE-2008-0882- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-0882No score
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.
- Record
DEBIAN-CVE-2008-0882- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9625
secunia.com/advisories/29485
bugzilla.redhat.com/show_bug.cgi?id=433758
Show 29 moreShow less
cups.org/str.php?L2656
lists.opensuse.org/opensuse-security-announce/2008-03/msg00000.html
redhat.com/archives/fedora-package-announce/2008-February/msg00792.html
vupen.com/english/advisories/2008/0924/references
securitytracker.com/id?1019473
ubuntu.com/usn/usn-598-1
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
mandriva.com/security/advisories?name=MDVSA-2008:050
docs.info.apple.com/article.html?artnum=307562
securityfocus.com/bid/27906
debian.org/security/2008/dsa-1530
security.gentoo.org/glsa/glsa-200804-01.xml
nvd.nist.gov/vuln/detail/CVE-2008-0882
github.com/advisories/GHSA-vcjx-xf8c-qxqm
security-tracker.debian.org/tracker/CVE-2008-0882
access.redhat.com/errata/RHSA-2008:0157
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0157.json
cve.org/CVERecord?id=CVE-2008-0882
Left out here: 24 versions. The JSON record has them.