Read the docs
TI-2009-02685 Aliases CVE-2009-2820GHSA-hmf5-7mhf-fpjh

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other…

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Why it matters now

EPSS 0.0578 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 118

CPEVersionsRoleVendor
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*up to 10.6.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.0:*:*:*:*:*:*:*10.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.0.1:*:*:*:*:*:*:*10.0.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.0.2:*:*:*:*:*:*:*10.0.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.0.3:*:*:*:*:*:*:*10.0.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.0.4:*:*:*:*:*:*:*10.0.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.1:*:*:*:*:*:*:*10.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.1.0:*:*:*:*:*:*:*10.1.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.1.1:*:*:*:*:*:*:*10.1.1VulnerableApple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions up to 10.6.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.0.2:*:*:*:*:*:*:* Versions 10.0.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.0.3:*:*:*:*:*:*:* Versions 10.0.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.0.4:*:*:*:*:*:*:* Versions 10.0.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.1.0:*:*:*:*:*:*:* Versions 10.1.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.1.1:*:*:*:*:*:*:* Versions 10.1.1 Vulnerable ·Apple
Show 108 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:apple:mac_os_x:10.1.2:*:*:*:*:*:*:*10.1.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.1.3:*:*:*:*:*:*:*10.1.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.1.4:*:*:*:*:*:*:*10.1.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.1.5:*:*:*:*:*:*:*10.1.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2:*:*:*:*:*:*:*10.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.0:*:*:*:*:*:*:*10.2.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.1:*:*:*:*:*:*:*10.2.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.2:*:*:*:*:*:*:*10.2.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.3:*:*:*:*:*:*:*10.2.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.4:*:*:*:*:*:*:*10.2.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.5:*:*:*:*:*:*:*10.2.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.6:*:*:*:*:*:*:*10.2.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.7:*:*:*:*:*:*:*10.2.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.2.8:*:*:*:*:*:*:*10.2.8VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3:*:*:*:*:*:*:*10.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.0:*:*:*:*:*:*:*10.3.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.1:*:*:*:*:*:*:*10.3.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.2:*:*:*:*:*:*:*10.3.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.3:*:*:*:*:*:*:*10.3.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.4:*:*:*:*:*:*:*10.3.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.5:*:*:*:*:*:*:*10.3.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.6:*:*:*:*:*:*:*10.3.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.7:*:*:*:*:*:*:*10.3.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.8:*:*:*:*:*:*:*10.3.8VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*10.3.9VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4:*:*:*:*:*:*:*10.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.0:*:*:*:*:*:*:*10.4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*10.4.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*10.4.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*10.4.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*10.4.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*10.4.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*10.4.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*10.4.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*10.4.8VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*10.4.9VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*10.4.10VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*10.4.11VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*10.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.0:*:*:*:*:*:*:*10.5.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*10.5.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*10.5.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:*10.5.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*10.5.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:*10.5.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.6:*:*:*:*:*:*:*10.5.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:*10.5.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*10.5.8VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.6:*:*:*:*:*:*:*10.6VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*up to 10.6.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.0:*:*:*:*:*:*:*10.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.0.1:*:*:*:*:*:*:*10.0.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.0.2:*:*:*:*:*:*:*10.0.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.0.3:*:*:*:*:*:*:*10.0.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.0.4:*:*:*:*:*:*:*10.0.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1:*:*:*:*:*:*:*10.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1.0:*:*:*:*:*:*:*10.1.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1.1:*:*:*:*:*:*:*10.1.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1.2:*:*:*:*:*:*:*10.1.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1.3:*:*:*:*:*:*:*10.1.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1.4:*:*:*:*:*:*:*10.1.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.1.5:*:*:*:*:*:*:*10.1.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2:*:*:*:*:*:*:*10.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.0:*:*:*:*:*:*:*10.2.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.1:*:*:*:*:*:*:*10.2.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.2:*:*:*:*:*:*:*10.2.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.3:*:*:*:*:*:*:*10.2.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.4:*:*:*:*:*:*:*10.2.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.5:*:*:*:*:*:*:*10.2.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.6:*:*:*:*:*:*:*10.2.6VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.7:*:*:*:*:*:*:*10.2.7VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.2.8:*:*:*:*:*:*:*10.2.8VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3:*:*:*:*:*:*:*10.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.0:*:*:*:*:*:*:*10.3.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.1:*:*:*:*:*:*:*10.3.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.2:*:*:*:*:*:*:*10.3.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.3:*:*:*:*:*:*:*10.3.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.4:*:*:*:*:*:*:*10.3.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.5:*:*:*:*:*:*:*10.3.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.6:*:*:*:*:*:*:*10.3.6VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.7:*:*:*:*:*:*:*10.3.7VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.8:*:*:*:*:*:*:*10.3.8VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:*10.3.9VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4:*:*:*:*:*:*:*10.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.0:*:*:*:*:*:*:*10.4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*10.4.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*10.4.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*10.4.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*10.4.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*10.4.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*10.4.6VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*10.4.7VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*10.4.8VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*10.4.9VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*10.4.10VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*10.4.11VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*10.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.0:*:*:*:*:*:*:*10.5.0VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*10.5.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*10.5.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*10.5.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*10.5.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*10.5.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.6:*:*:*:*:*:*:*10.5.6VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.7:*:*:*:*:*:*:*10.5.7VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*10.5.8VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.6:*:*:*:*:*:*:*10.6VulnerableApple
  • cpe:2.3:o:apple:mac_os_x:10.1.2:*:*:*:*:*:*:* Versions 10.1.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.1.3:*:*:*:*:*:*:* Versions 10.1.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.1.4:*:*:*:*:*:*:* Versions 10.1.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.1.5:*:*:*:*:*:*:* Versions 10.1.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.1:*:*:*:*:*:*:* Versions 10.2.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.2:*:*:*:*:*:*:* Versions 10.2.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.3:*:*:*:*:*:*:* Versions 10.2.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.4:*:*:*:*:*:*:* Versions 10.2.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.5:*:*:*:*:*:*:* Versions 10.2.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.6:*:*:*:*:*:*:* Versions 10.2.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.7:*:*:*:*:*:*:* Versions 10.2.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.2.8:*:*:*:*:*:*:* Versions 10.2.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.0:*:*:*:*:*:*:* Versions 10.3.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.1:*:*:*:*:*:*:* Versions 10.3.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.2:*:*:*:*:*:*:* Versions 10.3.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.3:*:*:*:*:*:*:* Versions 10.3.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.4:*:*:*:*:*:*:* Versions 10.3.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.5:*:*:*:*:*:*:* Versions 10.3.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.6:*:*:*:*:*:*:* Versions 10.3.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.7:*:*:*:*:*:*:* Versions 10.3.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.8:*:*:*:*:*:*:* Versions 10.3.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:* Versions 10.3.9 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4:*:*:*:*:*:*:* Versions 10.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.0:*:*:*:*:*:*:* Versions 10.4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:* Versions 10.4.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:* Versions 10.4.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:* Versions 10.4.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:* Versions 10.4.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:* Versions 10.4.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:* Versions 10.4.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:* Versions 10.4.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:* Versions 10.4.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:* Versions 10.4.9 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:* Versions 10.4.10 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:* Versions 10.4.11 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:* Versions 10.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:* Versions 10.5.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:* Versions 10.5.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:* Versions 10.5.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:* Versions 10.5.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:* Versions 10.5.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.6:*:*:*:*:*:*:* Versions 10.5.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:* Versions 10.5.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:* Versions 10.5.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6:*:*:*:*:*:*:* Versions 10.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:* Versions up to 10.6.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.0.2:*:*:*:*:*:*:* Versions 10.0.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.0.3:*:*:*:*:*:*:* Versions 10.0.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.0.4:*:*:*:*:*:*:* Versions 10.0.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1.0:*:*:*:*:*:*:* Versions 10.1.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1.1:*:*:*:*:*:*:* Versions 10.1.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1.2:*:*:*:*:*:*:* Versions 10.1.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1.3:*:*:*:*:*:*:* Versions 10.1.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1.4:*:*:*:*:*:*:* Versions 10.1.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.1.5:*:*:*:*:*:*:* Versions 10.1.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.1:*:*:*:*:*:*:* Versions 10.2.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.2:*:*:*:*:*:*:* Versions 10.2.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.3:*:*:*:*:*:*:* Versions 10.2.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.4:*:*:*:*:*:*:* Versions 10.2.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.5:*:*:*:*:*:*:* Versions 10.2.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.6:*:*:*:*:*:*:* Versions 10.2.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.7:*:*:*:*:*:*:* Versions 10.2.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.2.8:*:*:*:*:*:*:* Versions 10.2.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.0:*:*:*:*:*:*:* Versions 10.3.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.1:*:*:*:*:*:*:* Versions 10.3.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.2:*:*:*:*:*:*:* Versions 10.3.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.3:*:*:*:*:*:*:* Versions 10.3.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.4:*:*:*:*:*:*:* Versions 10.3.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.5:*:*:*:*:*:*:* Versions 10.3.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.6:*:*:*:*:*:*:* Versions 10.3.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.7:*:*:*:*:*:*:* Versions 10.3.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.8:*:*:*:*:*:*:* Versions 10.3.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:* Versions 10.3.9 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4:*:*:*:*:*:*:* Versions 10.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.0:*:*:*:*:*:*:* Versions 10.4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:* Versions 10.4.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:* Versions 10.4.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:* Versions 10.4.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:* Versions 10.4.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:* Versions 10.4.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:* Versions 10.4.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:* Versions 10.4.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:* Versions 10.4.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:* Versions 10.4.9 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:* Versions 10.4.10 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:* Versions 10.4.11 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:* Versions 10.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:* Versions 10.5.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:* Versions 10.5.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:* Versions 10.5.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:* Versions 10.5.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:* Versions 10.5.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.6:*:*:*:*:*:*:* Versions 10.5.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.7:*:*:*:*:*:*:* Versions 10.5.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:* Versions 10.5.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6:*:*:*:*:*:*:* Versions 10.6 Vulnerable ·Apple

Remediation

Red Hat 1 advisory

  • RHSA-2009:1595 Released 2009-11-18 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux (v. 5 server) cups-1:1.3.7-11.el5_4.4, cups-1:1.3.7-11.el5_4.4.i386, cups-1:1.3.7-11.el5_4.4.ia64 +13
    • Red Hat Enterprise Linux Desktop (v. 5 client) cups-1:1.3.7-11.el5_4.4, cups-1:1.3.7-11.el5_4.4.i386, cups-libs-1:1.3.7-11.el5_4.4 +3
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) cups-1:1.3.7-11.el5_4.4, cups-devel-1:1.3.7-11.el5_4.4, cups-devel-1:1.3.7-11.el5_4.4.i386

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1595
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1595
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1595

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2820
  2. 2026-10-03 Alias added: GHSA-hmf5-7mhf-fpjh

References

Patch 1

Advisory 5

Other 6

  • TI-2021-01573 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-01572 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-01607 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-02117 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 3209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences