USN-6844-2
cups regression
USN-6844-1 fixed vulnerabilities in the CUPS package. The update lead to the discovery of a regression in CUPS with regards to how the cupsd daemon handles Listen configuration directive. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details: Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.
What each source reports
OSV No score
cups regression
USN-6844-1 fixed vulnerabilities in the CUPS package. The update lead to the discovery of a regression in CUPS with regards to how the cupsd daemon handles Listen configuration directive. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details: Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.
- Record
USN-6844-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cupsUbuntu:Pro:16.04:LTS |
before 2.1.3-4ubuntu0.11+esm7, plus listed versions 2.1.0-4ubuntu32.1.0-52.1.0-62.1.0-6ubuntu12.1.0-7 Show 22 moreShow less2.1.2-12.1.2-22.1.3-12.1.3-1build12.1.3-32.1.3-42.1.3-4ubuntu0.22.1.3-4ubuntu0.32.1.3-4ubuntu0.42.1.3-4ubuntu0.52.1.3-4ubuntu0.62.1.3-4ubuntu0.72.1.3-4ubuntu0.82.1.3-4ubuntu0.92.1.3-4ubuntu0.102.1.3-4ubuntu0.112.1.3-4ubuntu0.11+esm12.1.3-4ubuntu0.11+esm22.1.3-4ubuntu0.11+esm32.1.3-4ubuntu0.11+esm42.1.3-4ubuntu0.11+esm52.1.3-4ubuntu0.11+esm6 |
2.1.3-4ubuntu0.11+esm7 |
cupsUbuntu:Pro:18.04:LTS |
before 2.2.7-1ubuntu2.10+esm5, plus listed versions 2.2.4-7ubuntu22.2.5-22.2.6-22.2.6-32.2.6-4 Show 17 moreShow less2.2.6-52.2.7-1ubuntu12.2.7-1ubuntu22.2.7-1ubuntu2.12.2.7-1ubuntu2.22.2.7-1ubuntu2.32.2.7-1ubuntu2.42.2.7-1ubuntu2.52.2.7-1ubuntu2.62.2.7-1ubuntu2.72.2.7-1ubuntu2.82.2.7-1ubuntu2.92.2.7-1ubuntu2.102.2.7-1ubuntu2.10+esm12.2.7-1ubuntu2.10+esm22.2.7-1ubuntu2.10+esm32.2.7-1ubuntu2.10+esm4 |
2.2.7-1ubuntu2.10+esm5 |
cupsUbuntu:20.04:LTS |
before 2.3.1-9ubuntu1.8, plus listed versions 2.2.12-2ubuntu12.3.0-62.3.0-72.3.0-7ubuntu12.3.1-1ubuntu1 Show 11 moreShow less2.3.1-22.3.1-42.3.1-72.3.1-9ubuntu12.3.1-9ubuntu1.12.3.1-9ubuntu1.22.3.1-9ubuntu1.32.3.1-9ubuntu1.42.3.1-9ubuntu1.52.3.1-9ubuntu1.62.3.1-9ubuntu1.7 |
2.3.1-9ubuntu1.8 |
cupsUbuntu:22.04:LTS |
before 2.4.1op1-1ubuntu4.10, plus listed versions 2.3.3op2-7ubuntu22.4.1op1-1ubuntu12.4.1op1-1ubuntu22.4.1op1-1ubuntu32.4.1op1-1ubuntu4 Show 7 moreShow less2.4.1op1-1ubuntu4.12.4.1op1-1ubuntu4.22.4.1op1-1ubuntu4.42.4.1op1-1ubuntu4.62.4.1op1-1ubuntu4.72.4.1op1-1ubuntu4.82.4.1op1-1ubuntu4.9 |
2.4.1op1-1ubuntu4.10 |
cupsUbuntu:24.04:LTS |
before 2.4.7-1.2ubuntu7.2, plus listed versions 2.4.6-0ubuntu32.4.7-1.2ubuntu22.4.7-1.2ubuntu32.4.7-1.2ubuntu72.4.7-1.2ubuntu7.1 |
2.4.7-1.2ubuntu7.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6844-2 is a vulnerability with no CVSS score yet in cups, published June 28, 2024. No source lists public exploit code. Fixed in cups 2.1.3-4ubuntu0.11+esm7.