Every CVE Search/ Get API key

CVE-2008-5286

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote...

7.5 HighFix available

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Exploit likelihood

4.40%Down 7.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
CVE-2008-5286
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
CVE-2008-5286
Updated
2026-11-02
EUVDEUVD-2008-5263 No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
EUVD-2008-5263
Updated
2026-11-03
GitHub AdvisoriesGHSA-wj8g-27x5-crw6 No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote...

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
GHSA-wj8g-27x5-crw6
Updated
2026-11-02
OSV No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
CVE-2008-5286
Updated
2026-11-02
OSVDEBIAN-CVE-2008-5286 No score

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

Record
DEBIAN-CVE-2008-5286
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
 before 1.3.8-1lenny4
1.3.8-1lenny4
cups
Debian:13
 before 1.3.8-1lenny4
1.3.8-1lenny4
cups
Debian:14
 before 1.3.8-1lenny4
1.3.8-1lenny4
cupsys
Debian:4.0
 before 1.2.7-4etch6, plus listed versions
1.2.7-41.2.7-4etch11.2.7-4etch21.2.7-4etch31.2.7-4etch41.2.7-4etch5
1.2.7-4etch6
cups
Red Hat:enterprise_linux:3::as
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::as
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-devel
Red Hat:enterprise_linux:3::as
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::as
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups
Red Hat:enterprise_linux:3::desktop
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
Show 10 moreShow less
Affected packages
PackageAffectedFixed
cups-devel
Red Hat:enterprise_linux:3::desktop
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::desktop
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups
Red Hat:enterprise_linux:3::es
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::es
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-devel
Red Hat:enterprise_linux:3::es
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::es
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups
Red Hat:enterprise_linux:3::ws
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-debuginfo
Red Hat:enterprise_linux:3::ws
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-devel
Red Hat:enterprise_linux:3::ws
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55
cups-libs
Red Hat:enterprise_linux:3::ws
 before 1:1.1.17-13.3.55
1:1.1.17-13.3.55

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-5286 is a high vulnerability (CVSS 7.5) in Apple Cups, published December 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.40%, the 91st percentile. Fixed in cups 1.3.8-1lenny4.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open