openSUSE-SU-2026:21850-1

openSUSE-SU-2026:21850-1 · Security update for cups-filters

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

This update for cups-filters fixes the following issues: Changes in cups-filters: - CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field. A user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop. (bsc#1273145,GHSA-rcq7-rv5g-j3r4) - CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery) A authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG. (bsc#1273146,GHSA-7mxj-cfq5-84ch) - Provide cups-browsed as separated cups-filters-cups-browsed sub-package so users can uninstall this sub-package to completely avoid the generic security risk of cups-browsed. cups-browsed auto-creates local print queues for printers which are announced via DNS-SD. It is a generic security risk when a service (cups-browsed.service) accepts any (possibly malicious) incoming information from any host in the local network (i.e. any DNS-SD announcements) and from that information it auto-creates print queue configurations for CUPS (where its server program cupsd runs as root). For more information see the openSUSE support database article https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings - Fixed a regression "Error about PPD file during 'driverless' printer setup" (boo#1256868) and "ppd pull out from [driverless] printer feature broken" (bsc#1256977) - unbreak qpdf [bsc#1253678] - CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939) and to avoid CVE-2024-47850 "cups-browsed can be abused to initiate remote DDoS against third-party targets" (bsc#1231294) by removing legacy CUPS Browsing support in cups-browsed (introduced 2012) which is no longer needed nowadays. CUPS browsing was removed from CUPS since version 1.6. Legacy CUPS Browsing is a generic security risk, see the section "Automated print queue setup via cups-browsed" in https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings - CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937) - CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932) - In general regarding CUPS and cups-browsed security issues see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

Correctif disponible

Publication

2026-09-14T13:25:38Z

Mise à jour

2026-09-15T17:00:06.697828124Z

Pile logicielle: system

Vérifiez votre serveur →