Every CVESearch/Get API key

CVE-2008-5286

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote...

7.5 HighFix available

CVE-2008-5286 is a high vulnerability (CVSS 7.5) in Apple Cups, published December 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.40%, the 91st percentile. Fixed in cups 1.3.8-1lenny4.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
4.40%EPSS, 91st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.3.8-1lenny4cups +19 more

Description

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Exploit likelihood

4.40%Down 7.0 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
before 1.3.8-1lenny4
1.3.8-1lenny4
cups
Debian:13
before 1.3.8-1lenny4
1.3.8-1lenny4
cups
Debian:14
before 1.3.8-1lenny4
1.3.8-1lenny4
cupsys
Debian:4.0
before 1.2.7-4etch6, plus listed versions
1.2.7-41.2.7-4etch11.2.7-4etch21.2.7-4etch31.2.7-4etch41.2.7-4etch5
1.2.7-4etch6
cups
Red Hat:enterprise_linux:3::as
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::as
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-devel
Red Hat:enterprise_linux:3::as
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::as
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups
Red Hat:enterprise_linux:3::desktop
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::desktop
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
Show 10 moreShow less
Affected packages
PackageAffectedFixed
cups-devel
Red Hat:enterprise_linux:3::desktop
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::desktop
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups
Red Hat:enterprise_linux:3::es
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::es
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-devel
Red Hat:enterprise_linux:3::es
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::es
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups
Red Hat:enterprise_linux:3::ws
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::ws
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-devel
Red Hat:enterprise_linux:3::ws
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::ws
before 1:1.1.17-13.3.55
1:1.1.17-13.3.55

What each source reports

NVD Score used7.5

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
CVE-2008-5286
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE ListNo score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
CVE-2008-5286
Updated
2026-11-02
EUVDEUVD-2008-5263No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
EUVD-2008-5263
Updated
2026-11-03
GitHub AdvisoriesGHSA-wj8g-27x5-crw6No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote...

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
GHSA-wj8g-27x5-crw6
Updated
2026-11-02
OSVNo score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
CVE-2008-5286
Updated
2026-11-02
OSVDEBIAN-CVE-2008-5286No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
DEBIAN-CVE-2008-5286
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 22 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open