diff -up cups-1.4.4/cups/ipp.c.CVE-2010-2941 cups-1.4.4/cups/ipp.c
--- cups-1.4.4/cups/ipp.c.CVE-2010-2941	2010-04-23 19:56:34.000000000 +0100
+++ cups-1.4.4/cups/ipp.c	2010-11-11 11:30:28.566745595 +0000
@@ -1275,7 +1275,9 @@ ippReadIO(void       *src,		/* I - Data 
 
 	      attr->value_tag = tag;
 	    }
-	    else if ((value_tag >= IPP_TAG_TEXTLANG &&
+	    else if (value_tag == IPP_TAG_TEXTLANG ||
+	             value_tag == IPP_TAG_NAMELANG ||
+		     (value_tag >= IPP_TAG_TEXT &&
 		      value_tag <= IPP_TAG_MIMETYPE))
             {
 	     /*
@@ -1283,8 +1285,9 @@ ippReadIO(void       *src,		/* I - Data 
 	      * forms; accept sets of differing values...
 	      */
 
-	      if ((tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE) &&
-	          tag != IPP_TAG_NOVALUE)
+	      if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&
+	          (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE) &&
+		  tag != IPP_TAG_NOVALUE)
 	      {
 		DEBUG_printf(("1ippReadIO: 1setOf value tag %x(%s) != %x(%s)",
 			      value_tag, ippTagString(value_tag), tag,
@@ -2766,6 +2769,7 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I
   {
     case IPP_TAG_TEXT :
     case IPP_TAG_NAME :
+    case IPP_TAG_RESERVED_STRING :
     case IPP_TAG_KEYWORD :
     case IPP_TAG_URI :
     case IPP_TAG_URISCHEME :
diff -up cups-1.4.4/cups/ipp.h.CVE-2010-2941 cups-1.4.4/cups/ipp.h
--- cups-1.4.4/cups/ipp.h.CVE-2010-2941	2010-04-23 19:56:34.000000000 +0100
+++ cups-1.4.4/cups/ipp.h	2010-11-11 11:30:28.568745537 +0000
@@ -93,7 +93,8 @@ typedef enum ipp_tag_e			/**** Format ta
   IPP_TAG_END_COLLECTION,		/* End of collection value */
   IPP_TAG_TEXT = 0x41,			/* Text value */
   IPP_TAG_NAME,				/* Name value */
-  IPP_TAG_KEYWORD = 0x44,		/* Keyword value */
+  IPP_TAG_RESERVED_STRING,		/* Reserved for future string value @private@ */
+  IPP_TAG_KEYWORD,			/* Keyword value */
   IPP_TAG_URI,				/* URI value */
   IPP_TAG_URISCHEME,			/* URI scheme value */
   IPP_TAG_CHARSET,			/* Character set value */