CVE-2009-4526

The CVE-2009-4526 entry affects the Drupal module Print (aka Printer, e-mail and PDF versions), specifically the Send by e-mail sub-module. Affected versions are 5.x before 5.x-4.9 and 6.x before 6.x-1.9. The vulnerability arises from not properly enforcing privilege requirements, allowing remote...

CVE-2009-4526

The Send by e-mail sub-module in the Print aka Printer, e-mail and PDF versions module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, does not properly enforce privilege requirements, which allows remote attackers to read page titles by requesting a "Send to friend" form...

CVE-2009-4525

CVE-2009-4525 is a Drupal Print module XSS vulnerability: versions 5.x before 5.x-4.9 and 6.x before 6.x-1.9 allow remote attackers to inject arbitrary web script or HTML via crafted data in a list of links. Remediation details are not provided in the supplied documents.

DEBIAN-CVE-2009-3553

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service daemon crash or hang via a client disconnection during listin...

CVE-2009-3553

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service daemon crash or hang via a client disconnection during listin...

cups: Several XSS flaws in forms processed by CUPS web interface

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle 1 HTTP headers and 2 HTML templates, which allows remote attackers to conduct cross-site scripting XSS attacks and HTTP response splitting attacks via vectors related to a...

cups: Use-after-free (crash) due improper reference counting in abstract file descriptors handling interface

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service daemon crash or hang via a client disconnection during listin...

CVE-2009-2820

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle 1 HTTP headers and 2 HTML templates, which allows remote attackers to conduct cross-site scripting XSS attacks and HTTP response splitting attacks via vectors related to a...

CVE-2009-2820

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle 1 HTTP headers and 2 HTML templates, which allows remote attackers to conduct cross-site scripting XSS attacks and HTTP response splitting attacks via vectors related to a...

CVE-2009-2820

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle 1 HTTP headers and 2 HTML templates, which allows remote attackers to conduct cross-site scripting XSS attacks and HTTP response splitting attacks via vectors related to a...

array index error in dtoa implementation of many products

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

Multiple Vendors CUPS HPGL Filter Remote Code Execution (CVE-2008-3641)

The Common Unix Printing System CUPS is a modular printing system for Unix-like operating systems that allows a computer to act as a print server. A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer. There exis...

CVE-2009-3210

Multiple cross-site scripting XSS vulnerabilities in the Print aka Printer, e-mail and PDF versions module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Print aka Printer, e-mail and PDF versions module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-3210

Multiple cross-site scripting XSS vulnerabilities in the Print aka Printer, e-mail and PDF versions module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-3210

CVE-2009-3210 involves a vulnerability in Drupal’s Print (Printer, e-mail and PDF versions) module. Affected versions are Drupal 5.x prior to 5.x-4.8 and 6.x prior to 6.x-1.8. The issue is described as multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to in...

Code injection

in.lpd in the print service in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service memory consumption via unspecified vectors that trigger a "fork/exec bomb."...

CVE-2009-2972

CVE-2009-2972 affects Sun Solaris 8/9; the in.lpd print service is vulnerable to a remote fork/exec() bomb that can cause higher memory usage and denial of service. Relevant patches exist: Solaris 8 (sparc) 109320-22 and 109321-22 (x86); Solaris 9 114980-31. No exploitation details are provided i...

CVE-2008-7075

Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbitrary SQL commands via 1 the subcatid parameter to article.list.php; or the artid parameter to 2 article.print.php, 3 article.comments.php, 4 article.publisher.php, or 5...

[Full-disclosure] Drupal Print Module Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vulnerability Report Date of Original Vendor Contact: May 27, 2009 Author: Justin C. Klein Keane [email protected] Details of this vulnerability are also posted at the public URL http://lampsecurity.org/drupal-print-module-vulnerabilities Descriptio...