{"id":"DEBIAN-CVE-2010-1748","details":"The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.","modified":"2026-09-18T06:47:20.600393979Z","published":"2010-06-17T16:30:01.920Z","upstream":["CVE-2010-1748"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2010-1748"}],"affected":[{"package":{"name":"cups","ecosystem":"Debian:12","purl":"pkg:deb/debian/cups?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1748.json"}},{"package":{"name":"cups","ecosystem":"Debian:13","purl":"pkg:deb/debian/cups?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1748.json"}},{"package":{"name":"cups","ecosystem":"Debian:14","purl":"pkg:deb/debian/cups?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1748.json"}}],"schema_version":"1.9.0"}