The directory-services functionality in the scheduler in CUPS 1.1.17 and 1.1.22 allows remote attackers to cause a denial of service (cupsd daemon outage or crash) via manipulations of the timing of CUPS browse packets, related to a "pointer use-after-delete flaw."
Mandriva Linux Security Advisory 2009-283 - cups suffers from denial of service, integer overflow, and buffer overflow vulnerabilities. This update corrects the problems.