cupsd in CUPS 1.3.9 and earlier allows local users and possibly remote attackers to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.