CVE-2002-1372

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-252

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.htmlBroken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702Broken Link
http://marc.info/?l=bugtraq&m=104032149026670&w=2Mailing List
http://www.debian.org/security/2003/dsa-232Third Party Advisory
http://www.idefense.com/advisory/12.19.02.txtBroken Link, Exploit, Vendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:001Broken Link
http://www.novell.com/linux/security/advisories/2003_002_cups.htmlBroken Link
http://www.redhat.com/support/errata/RHSA-2002-295.htmlBroken Link
http://www.securityfocus.com/bid/6440Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/10912Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0117.htmlBroken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000702Broken Link
http://marc.info/?l=bugtraq&m=104032149026670&w=2Mailing List
http://www.debian.org/security/2003/dsa-232Third Party Advisory
http://www.idefense.com/advisory/12.19.02.txtBroken Link, Exploit, Vendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:001Broken Link
http://www.novell.com/linux/security/advisories/2003_002_cups.htmlBroken Link
http://www.redhat.com/support/errata/RHSA-2002-295.htmlBroken Link
http://www.securityfocus.com/bid/6440Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/10912Third Party Advisory, VDB Entry

Timeline

Published: Dec 26, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-13735.0Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of serv CVE-2002-13747.5The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force CVE-2002-13757.5The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long resp CVE-2002-13767.5libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the CVE-2002-13774.6vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which a CVE-2002-13787.5Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r CVE-2002-13797.5OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file with CVE-2002-13802.1Linux kernel 2.2.x allows local users to cause a denial of service (crash) by using the mmap() function with a PROT_READ parameter to access CVE-2002-13817.2Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitra CVE-2002-13827.5Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Fl CVE-2002-138310.0Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via CVE-2002-13847.2Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code