diff -up cups-1.3.7/cups/ipp.c.CVE-2010-2941 cups-1.3.7/cups/ipp.c
--- cups-1.3.7/cups/ipp.c.CVE-2010-2941	2008-02-16 00:45:36.000000000 +0000
+++ cups-1.3.7/cups/ipp.c	2010-10-26 10:35:37.299870941 +0100
@@ -1187,15 +1187,18 @@ ippReadIO(void       *src,		/* I - Data 
 
 	      attr->value_tag = tag;
 	    }
-	    else if (value_tag >= IPP_TAG_TEXTLANG &&
-		     value_tag <= IPP_TAG_MIMETYPE)
+	    else if (value_tag == IPP_TAG_TEXTLANG ||
+		     value_tag == IPP_TAG_NAMELANG ||
+		     (value_tag >= IPP_TAG_TEXT &&
+		      value_tag <= IPP_TAG_MIMETYPE))
             {
 	     /*
 	      * String values can sometimes come across in different
 	      * forms; accept sets of differing values...
 	      */
 
-	      if (tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE)
+	      if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&
+		  (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE))
 	        return (IPP_ERROR);
             }
 	    else if (value_tag != tag)
@@ -2523,6 +2526,7 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I
   {
     case IPP_TAG_TEXT :
     case IPP_TAG_NAME :
+    case IPP_TAG_RESERVED_STRING :
     case IPP_TAG_KEYWORD :
     case IPP_TAG_URI :
     case IPP_TAG_URISCHEME :
diff -up cups-1.3.7/cups/ipp.h.CVE-2010-2941 cups-1.3.7/cups/ipp.h
--- cups-1.3.7/cups/ipp.h.CVE-2010-2941	2007-10-31 18:35:56.000000000 +0000
+++ cups-1.3.7/cups/ipp.h	2010-10-26 10:35:37.300871438 +0100
@@ -94,7 +94,8 @@ typedef enum ipp_tag_e			/**** Format ta
   IPP_TAG_END_COLLECTION,		/* End of collection value */
   IPP_TAG_TEXT = 0x41,			/* Text value */
   IPP_TAG_NAME,				/* Name value */
-  IPP_TAG_KEYWORD = 0x44,		/* Keyword value */
+  IPP_TAG_RESERVED_STRING,		/* Reserved for future string value @private@ */
+  IPP_TAG_KEYWORD,			/* Keyword value */
   IPP_TAG_URI,				/* URI value */
   IPP_TAG_URISCHEME,			/* URI scheme value */
   IPP_TAG_CHARSET,			/* Character set value */