{"id":"CVE-2025-61915","aliases":["ALPINE-CVE-2025-61915","ALSA-2026:0312","ALSA-2026:0464","ALSA-2026:0596","AZL-71146","AZL-71152","BELL-CVE-2025-61915","CLSA-2026-1769515411","CLSA-2026-1769516003","DEBIAN-CVE-2025-61915","EUVD-2025-199891","GHSA-hxm8-vfpq-jrfc","MGASA-2025-0315","OESA-2026-1143","OESA-2026-1144","OESA-2026-1145","OESA-2026-1146","OESA-2026-1147","OESA-2026-1148","RHSA-2026:0312","RHSA-2026:0464","RHSA-2026:0596","RLSA-2026:0312","RLSA-2026:0464","RLSA-2026:0596","ROOT-OS-DEBIAN-12-CVE-2025-61915","ROOT-OS-DEBIAN-13-CVE-2025-61915","SUSE-SU-2025:4289-1","SUSE-SU-2025:4290-1","SUSE-SU-2026:20229-1","SUSE-SU-2026:20231-1","SUSE-SU-2026:20528-1","SUSE-SU-2026:20535-1","UBUNTU-CVE-2025-61915","USN-7897-1","openSUSE-SU-2026:10088-1","openSUSE-SU-2026:20172-1"],"status":"published","title":"OpenPrinting CUPS vulnerable to stack based out-of-bound write","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00496,"percentile":0.4306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-124","CWE-129"],"published":"2025-11-27T15:00:00Z","modified":"2026-10-29T11:32:20Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cups","fixed_in":["2.4.16-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cups","fixed_in":["2.3.3op2-11"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"cups","fixed_in":["2.4.9-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"cups","fixed_in":["2.4.16-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-client","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-devel","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filesystem","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-ipptool","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-libs","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-lpd","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-printerapp","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-client","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-devel","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-filesystem","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-ipptool","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-libs","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-lpd","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-printerapp","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.4.15-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"cups","fixed_in":["2.4.2-3+deb12u9.root.io.2","2.4.2-3+deb12u9.root.io.4","2.4.2-3+deb12u9.root.io.3","2.4.2-3+deb12u9.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-cups","fixed_in":["2.4.2-3+deb12u9.root.io.2","2.4.2-3+deb12u9.root.io.4","2.4.2-3+deb12u9.root.io.3","2.4.2-3+deb12u9.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"cups","fixed_in":["2.4.10-3+deb13u2.aikido.5","2.4.10-3+deb13u2.root.io.2","2.4.10-3+deb13u2.root.io.1","2.4.10-3+deb13u2.root.io.3","2.4.10-3+deb13u2.aikido.6","2.4.10-3+deb13u2.root.io.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-cups","fixed_in":["2.4.10-3+deb13u2.aikido.5","2.4.10-3+deb13u2.root.io.2","2.4.10-3+deb13u2.root.io.1","2.4.10-3+deb13u2.root.io.3","2.4.10-3+deb13u2.aikido.6","2.4.10-3+deb13u2.root.io.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups","fixed_in":["1.7.5-20.57.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups","fixed_in":["2.1.3-4ubuntu0.11+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups","fixed_in":["2.2.7-1ubuntu2.10+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups","fixed_in":["2.3.1-9ubuntu1.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cups","fixed_in":["2.4.1op1-1ubuntu4.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"cups","fixed_in":["2.4.7-1.2ubuntu7.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"cups","fixed_in":["2.4.12-0ubuntu3.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.10-12.el10_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3op2-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-r2"},{"fixed":"2.4.9-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.11-r1"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-r5"},{"fixed":"2.4.16-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-1","2.4.10-2","2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1","2.4.2-3","2.4.2-3+deb12u1","2.4.2-3+deb12u2","2.4.2-3+deb12u3","2.4.2-3+deb12u4","2.4.2-3+deb12u5","2.4.2-3+deb12u6","2.4.2-3+deb12u7","2.4.2-3+deb12u8","2.4.2-3+deb12u9","2.4.2-4","2.4.2-5","2.4.2-6","2.4.7-1","2.4.7-1.1","2.4.7-1.2","2.4.7-2","2.4.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-3","2.4.10-3+deb13u1","2.4.10-3+deb13u2","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.15-1"}]}],"versions":["2.4.10-3","2.4.10-4","2.4.14-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1.5.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-18.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-11.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-11.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-11.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-23.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-18.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-ipptool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-lpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cups-printerapp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-ipptool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-lpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cups-printerapp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.10-12.el10_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.10-12.el10_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-34.el9_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.10-12.el10_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.6-66.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3+deb12u9.root.io.2"},{"fixed":"2.4.2-3+deb12u9.root.io.4"},{"fixed":"2.4.2-3+deb12u9.root.io.3"},{"fixed":"2.4.2-3+deb12u9.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3+deb12u9.root.io.2"},{"fixed":"2.4.2-3+deb12u9.root.io.4"},{"fixed":"2.4.2-3+deb12u9.root.io.3"},{"fixed":"2.4.2-3+deb12u9.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-3+deb13u2.aikido.5"},{"fixed":"2.4.10-3+deb13u2.root.io.2"},{"fixed":"2.4.10-3+deb13u2.root.io.1"},{"fixed":"2.4.10-3+deb13u2.root.io.3"},{"fixed":"2.4.10-3+deb13u2.aikido.6"},{"fixed":"2.4.10-3+deb13u2.root.io.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-3+deb13u2.aikido.5"},{"fixed":"2.4.10-3+deb13u2.root.io.2"},{"fixed":"2.4.10-3+deb13u2.root.io.1"},{"fixed":"2.4.10-3+deb13u2.root.io.3"},{"fixed":"2.4.10-3+deb13u2.aikido.6"},{"fixed":"2.4.10-3+deb13u2.root.io.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.77.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.11+esm11"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5","2.1.3-4ubuntu0.6","2.1.3-4ubuntu0.7","2.1.3-4ubuntu0.8","2.1.3-4ubuntu0.9","2.1.3-4ubuntu0.10","2.1.3-4ubuntu0.11","2.1.3-4ubuntu0.11+esm1","2.1.3-4ubuntu0.11+esm2","2.1.3-4ubuntu0.11+esm3","2.1.3-4ubuntu0.11+esm4","2.1.3-4ubuntu0.11+esm5","2.1.3-4ubuntu0.11+esm6","2.1.3-4ubuntu0.11+esm7","2.1.3-4ubuntu0.11+esm8","2.1.3-4ubuntu0.11+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu2.10+esm9"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1","2.2.7-1ubuntu2.2","2.2.7-1ubuntu2.3","2.2.7-1ubuntu2.4","2.2.7-1ubuntu2.5","2.2.7-1ubuntu2.6","2.2.7-1ubuntu2.7","2.2.7-1ubuntu2.8","2.2.7-1ubuntu2.9","2.2.7-1ubuntu2.10","2.2.7-1ubuntu2.10+esm1","2.2.7-1ubuntu2.10+esm2","2.2.7-1ubuntu2.10+esm3","2.2.7-1ubuntu2.10+esm4","2.2.7-1ubuntu2.10+esm5","2.2.7-1ubuntu2.10+esm6","2.2.7-1ubuntu2.10+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-9ubuntu1.9+esm3"}]}],"versions":["2.2.12-2ubuntu1","2.3.0-6","2.3.0-7","2.3.0-7ubuntu1","2.3.1-1ubuntu1","2.3.1-2","2.3.1-4","2.3.1-7","2.3.1-9ubuntu1","2.3.1-9ubuntu1.1","2.3.1-9ubuntu1.2","2.3.1-9ubuntu1.3","2.3.1-9ubuntu1.4","2.3.1-9ubuntu1.5","2.3.1-9ubuntu1.6","2.3.1-9ubuntu1.7","2.3.1-9ubuntu1.8","2.3.1-9ubuntu1.9","2.3.1-9ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1op1-1ubuntu4.15"}]}],"versions":["2.3.3op2-7ubuntu2","2.4.1op1-1ubuntu1","2.4.1op1-1ubuntu2","2.4.1op1-1ubuntu3","2.4.1op1-1ubuntu4","2.4.1op1-1ubuntu4.1","2.4.1op1-1ubuntu4.2","2.4.1op1-1ubuntu4.4","2.4.1op1-1ubuntu4.6","2.4.1op1-1ubuntu4.7","2.4.1op1-1ubuntu4.8","2.4.1op1-1ubuntu4.9","2.4.1op1-1ubuntu4.10","2.4.1op1-1ubuntu4.11","2.4.1op1-1ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1.2ubuntu7.7"}]}],"versions":["2.4.6-0ubuntu3","2.4.7-1.2ubuntu2","2.4.7-1.2ubuntu3","2.4.7-1.2ubuntu7","2.4.7-1.2ubuntu7.1","2.4.7-1.2ubuntu7.2","2.4.7-1.2ubuntu7.3","2.4.7-1.2ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu3.3"}]}],"versions":["2.4.12-0ubuntu1","2.4.12-0ubuntu2","2.4.12-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.11+esm11"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5","2.1.3-4ubuntu0.6","2.1.3-4ubuntu0.7","2.1.3-4ubuntu0.8","2.1.3-4ubuntu0.9","2.1.3-4ubuntu0.10","2.1.3-4ubuntu0.11","2.1.3-4ubuntu0.11+esm1","2.1.3-4ubuntu0.11+esm2","2.1.3-4ubuntu0.11+esm3","2.1.3-4ubuntu0.11+esm4","2.1.3-4ubuntu0.11+esm5","2.1.3-4ubuntu0.11+esm6","2.1.3-4ubuntu0.11+esm7","2.1.3-4ubuntu0.11+esm8","2.1.3-4ubuntu0.11+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu2.10+esm9"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1","2.2.7-1ubuntu2.2","2.2.7-1ubuntu2.3","2.2.7-1ubuntu2.4","2.2.7-1ubuntu2.5","2.2.7-1ubuntu2.6","2.2.7-1ubuntu2.7","2.2.7-1ubuntu2.8","2.2.7-1ubuntu2.9","2.2.7-1ubuntu2.10","2.2.7-1ubuntu2.10+esm1","2.2.7-1ubuntu2.10+esm2","2.2.7-1ubuntu2.10+esm3","2.2.7-1ubuntu2.10+esm4","2.2.7-1ubuntu2.10+esm5","2.2.7-1ubuntu2.10+esm6","2.2.7-1ubuntu2.10+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-9ubuntu1.9+esm3"}]}],"versions":["2.2.12-2ubuntu1","2.3.0-6","2.3.0-7","2.3.0-7ubuntu1","2.3.1-1ubuntu1","2.3.1-2","2.3.1-4","2.3.1-7","2.3.1-9ubuntu1","2.3.1-9ubuntu1.1","2.3.1-9ubuntu1.2","2.3.1-9ubuntu1.3","2.3.1-9ubuntu1.4","2.3.1-9ubuntu1.5","2.3.1-9ubuntu1.6","2.3.1-9ubuntu1.7","2.3.1-9ubuntu1.8","2.3.1-9ubuntu1.9","2.3.1-9ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1op1-1ubuntu4.15"}]}],"versions":["2.3.3op2-7ubuntu2","2.4.1op1-1ubuntu1","2.4.1op1-1ubuntu2","2.4.1op1-1ubuntu3","2.4.1op1-1ubuntu4","2.4.1op1-1ubuntu4.1","2.4.1op1-1ubuntu4.2","2.4.1op1-1ubuntu4.4","2.4.1op1-1ubuntu4.6","2.4.1op1-1ubuntu4.7","2.4.1op1-1ubuntu4.8","2.4.1op1-1ubuntu4.9","2.4.1op1-1ubuntu4.10","2.4.1op1-1ubuntu4.11","2.4.1op1-1ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1.2ubuntu7.7"}]}],"versions":["2.4.6-0ubuntu3","2.4.7-1.2ubuntu2","2.4.7-1.2ubuntu3","2.4.7-1.2ubuntu7","2.4.7-1.2ubuntu7.1","2.4.7-1.2ubuntu7.2","2.4.7-1.2ubuntu7.3","2.4.7-1.2ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu3.3"}]}],"versions":["2.4.12-0ubuntu1","2.4.12-0ubuntu2","2.4.12-0ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"openprinting","product":"cups"}],"references":[{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/OpenPrinting/cups/releases/tag/v2.4.15","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/11/27/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-61915","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0312","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58436","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61915","tags":["report"]},{"url":"https://bugzilla.redhat.com/2416039","tags":["report"]},{"url":"https://bugzilla.redhat.com/2416040","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-0312.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0464","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-0464.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0596","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-0596.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61915","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-61915","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1769515411.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1769516003.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61915.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-61915","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0315.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34786","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/11/27/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/11/27/5","tags":["web"]},{"url":"https://github.com/OpenPrinting/cups/issues/1429","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58436","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1144","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1145","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1146","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1147","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1148","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416040","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0312.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3122","tags":["article"]},{"url":"https://go.dev/cl/709861","tags":["article"]},{"url":"https://go.dev/issue/75677","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4014","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58436","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61915","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0464.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0596.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0312","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0464","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0596","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253783","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61915","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254290-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234225","tags":["report"]},{"url":"https://bugzilla.suse.com/1244057","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58436","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620229-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249049","tags":["report"]},{"url":"https://bugzilla.suse.com/1249128","tags":["report"]},{"url":"https://bugzilla.suse.com/1254353","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58364","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620231-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620528-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620535-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-61915","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7897-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61915","title":"OpenPrinting CUPS vulnerable to stack based out-of-bound write","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T02:15:39.913Z","modified":"2025-12-03T15:52:35.319Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-129","CWE-124"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-199891","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T02:15:39Z","modified":"2025-12-03T15:52:35Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"nvd":[{"id":"CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T03:15:59.52Z","modified":"2026-10-07T20:10:01.97Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-124","CWE-129"],"updated_at":"2026-11-02T14:11:46.94029Z"}],"osv":[{"id":"ALPINE-CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T03:15:59.52Z","modified":"2026-08-27T22:18:02.996977312Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-61915","status":"published","published":"2025-11-29T06:07:07.91958Z","modified":"2026-01-30T07:15:43.950755Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-61915","title":"OpenPrinting CUPS vulnerable to stack based out-of-bound write","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T02:15:39.913Z","modified":"2026-10-28T11:00:14.990034936Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-124","CWE-129"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T03:15:59.52Z","modified":"2026-10-08T09:47:38.551159508Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"OESA-2026-1143","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)","status":"published","published":"2026-01-16T11:10:11Z","modified":"2026-08-18T01:19:28.807023177Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1144","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)","status":"published","published":"2026-01-16T11:10:11Z","modified":"2026-08-18T01:19:28.842171151Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1145","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)","status":"published","published":"2026-01-16T11:10:11Z","modified":"2026-08-18T01:19:28.484028007Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1146","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)","status":"published","published":"2026-01-16T11:10:11Z","modified":"2026-08-18T01:19:28.122286638Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1147","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)","status":"published","published":"2026-01-16T11:10:11Z","modified":"2026-08-18T01:19:28.488893473Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1148","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)","status":"published","published":"2026-01-16T11:10:11Z","modified":"2026-08-18T01:19:28.381648576Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"RHSA-2026:0312","title":"Red Hat Security Advisory: cups security update","status":"published","published":"2026-01-14T10:38:46Z","modified":"2026-10-20T10:04:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:0464","title":"Red Hat Security Advisory: cups security update","status":"published","published":"2026-01-14T10:39:22Z","modified":"2026-09-02T10:08:22Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:0596","title":"Red Hat Security Advisory: cups security update","status":"published","published":"2026-01-15T10:09:22Z","modified":"2026-09-02T10:08:23Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RLSA-2026:0312","title":"Moderate: cups security update","description":"The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.\n\nSecurity Fix(es):\n\n* CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)\n\n* cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-14T09:11:53.425821Z","modified":"2026-01-14T09:30:09.527238Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:0464","title":"Moderate: cups security update","description":"The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.\n\nSecurity Fix(es):\n\n* CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)\n\n* cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-15T09:16:30.973636Z","modified":"2026-01-15T09:45:06.618092Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:0596","title":"Moderate: cups security update","description":"The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.\n\nSecurity Fix(es):\n\n* CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)\n\n* cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-15T09:11:33.22915Z","modified":"2026-01-15T09:30:09.402379Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-61915","title":"CVE-2025-61915 in cups - Patched by Root","description":"Root has patched CVE-2025-61915 in the cups package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:44:39Z","modified":"2026-08-26T01:10:15.903014111Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2025-61915","title":"CVE-2025-61915 in cups - Patched by Root","description":"Root has patched CVE-2025-61915 in the cups package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T06:48:45Z","modified":"2026-08-24T08:15:07.450151472Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"UBUNTU-CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-27T15:00:00Z","modified":"2026-04-22T16:07:56.287645Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"ALSA-2026:0312","title":"Moderate: cups security update","description":"The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.  \n\nSecurity Fix(es):  \n\n  * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)\n  * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-08T00:00:00Z","modified":"2026-10-29T11:32:20.219831827Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:0464","title":"Moderate: cups security update","description":"The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.  \n\nSecurity Fix(es):  \n\n  * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)\n  * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-12T00:00:00Z","modified":"2026-10-29T11:30:14.075958202Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:0596","title":"Moderate: cups security update","description":"The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.  \n\nSecurity Fix(es):  \n\n  * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)\n  * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-14T00:00:00Z","modified":"2026-10-29T11:02:28.495046902Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-71146","title":"CVE-2025-61915 affecting package cups for versions less than 2.4.16-1","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T03:15:59Z","modified":"2026-04-21T04:48:33.539975Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"AZL-71152","title":"CVE-2025-61915 affecting package cups for versions less than 2.3.3op2-11","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.","status":"published","published":"2025-11-29T03:15:59Z","modified":"2026-04-21T04:36:32.177041Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"CLSA-2026-1769515411","title":"cups: Fix of CVE-2025-61915","description":"- CVE-2025-61915: fix out-of-bound write issue caused by inserting malicious\n  line in cups web UI config","status":"published","published":"2026-01-27T12:03:35Z","modified":"2026-06-01T00:31:40.301370276Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1769516003","title":"cups: Fix of CVE-2025-61915","description":"- CVE-2025-61915: fix out-of-bound write issue caused by inserting malicious\n  line in cups web UI config","status":"published","published":"2026-01-27T12:13:26Z","modified":"2026-06-01T00:32:40.348839995Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"MGASA-2025-0315","title":"Updated cups packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities and a regression with\nGTK+ apps caused by the fix for CVE-2025-58436:\nOpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS\nattack. (CVE-2025-58436)\nOpenPrinting CUPS vulnerable to stack based out-of-bound write.\n(CVE-2025-61915)\n","status":"published","published":"2025-12-03T20:39:56Z","modified":"2026-04-16T04:41:41.909986749Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10088-1","title":"cups-2.4.16-1.1 on GA media","description":"These are all security issues fixed in the cups-2.4.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-26T00:00:00Z","modified":"2026-03-23T04:54:26.455764Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20172-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\nUpdate to version 2.4.16.\n\nSecurity issues fixed:\n\n- CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).\n- CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).\n- CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference (bsc#1249128).\n- CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).\n\nOther updates and bugfixes:\n\n- Version upgrade to 2.4.16:\n\n  * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,\n    potentially reading past the end of the source string\n    (Issue #1438)\n  * The web interface did not support domain usernames fully\n    (Issue #1441)\n  * Fixed an infinite loop issue in the GTK+ print dialog\n    (Issue #1439 boo#1254353)\n  * Fixed stopping scheduler on unknown directive in\n    configuration (Issue #1443)\n  * Fixed packages for Immutable Mode (jsc#PED-14775\n    from epic jsc#PED-14688)\n\n- Version upgrade to 2.4.15:\n\n  * Fixed potential crash in 'cups-driverd' when there are\n    duplicate PPDs (Issue #1355)\n  * Fixed error recovery when scanning for PPDs\n    in 'cups-driverd' (Issue #1416)\n\n- Version upgrade to 2.4.14.\n\n- Version upgrade to 2.4.13:\n\n  * Added 'print-as-raster' printer and job attributes\n    for forcing rasterization (Issue #1282)\n  * Updated documentation (Issue #1086)\n  * Updated IPP backend to try a sanitized user name if the\n    printer/server does not like the value (Issue #1145)\n  * Updated the scheduler to send the \"printer-added\"\n    or \"printer-modified\" events  whenever an IPP Everywhere PPD\n    is installed (Issue #1244)\n  * Updated the scheduler to send the \"printer-modified\" event\n    whenever the system default printer is changed (Issue #1246)\n  * Fixed a memory leak in 'httpClose' (Issue #1223)\n  * Fixed missing commas in 'ippCreateRequestedArray'\n    (Issue #1234)\n  * Fixed subscription issues in the scheduler and D-Bus notifier\n    (Issue #1235)\n  * Fixed media-default reporting for custom sizes (Issue #1238)\n  * Fixed support for IPP/PPD options with periods or underscores\n    (Issue #1249)\n  * Fixed parsing of real numbers in PPD compiler source files\n    (Issue #1263)\n  * Fixed scheduler freezing with zombie clients (Issue #1264)\n  * Fixed support for the server name in the ErrorLog filename\n    (Issue #1277)\n  * Fixed job cleanup after daemon restart (Issue #1315)\n  * Fixed handling of buggy DYMO USB printer serial numbers\n   (Issue #1338)\n  * Fixed unreachable block in IPP backend (Issue #1351)\n  * Fixed memory leak in _cupsConvertOptions (Issue #1354)\n\n- Version upgrade to 2.4.12:\n\n  * GnuTLS follows system crypto policies now (Issue #1105)\n  * Added `NoSystem` SSLOptions value (Issue #1130)\n  * Now we raise alert for certificate issues (Issue #1194)\n  * Added Kyocera USB quirk (Issue #1198)\n  * The scheduler now logs a job's debugging history\n    if the backend fails (Issue #1205)\n  * Fixed a potential timing issue with `cupsEnumDests`\n    (Issue #1084)\n  * Fixed a potential \"lost PPD\" condition in the scheduler\n    (Issue #1109)\n  * Fixed a compressed file error handling bug (Issue #1070)\n  * Fixed a bug in the make-and-model whitespace trimming\n    code (Issue #1096)\n  * Fixed a removal of IPP Everywhere permanent queue\n    if installation failed (Issue #1102)\n  * Fixed `ServerToken None` in scheduler (Issue #1111)\n  * Fixed invalid IPP keyword values created from PPD\n    option names (Issue #1118)\n  * Fixed handling of \"media\" and \"PageSize\" in the same\n    print request (Issue #1125)\n  * Fixed client raster printing from macOS (Issue #1143)\n  * Fixed the default User-Agent string.\n  * Fixed a recursion issue in `ippReadIO`.\n  * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)\n  * Fixed validation of dateTime values with time zones\n    more than UTC+11 (Issue #1201)\n  * Fixed attributes returned by the Create-Xxx-Subscriptions\n    requests (Issue #1204)\n  * Fixed `ippDateToTime` when using a non GMT/UTC timezone\n    (Issue #1208)\n  * Fixed `job-completed` event notifications for jobs that are\n    cancelled before started (Issue #1209)\n  * Fixed DNS-SD discovery with `ippfind` (Issue #1211)\n","status":"published","published":"2026-02-04T11:37:13Z","modified":"2026-03-23T04:54:46.580632Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:4289-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2025-61915: Fixed local denial-of-service via cupsd.conf update (bsc#1253783) \n","status":"published","published":"2025-11-28T08:50:37Z","modified":"2026-02-04T03:44:04.025378Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4290-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2025-61915: Fixed a local denial-of-service via cupsd.conf update and related issues. (bsc#1253783)\n- CVE-2025-58436: Fixed an issue where a slow client communication leads to a possible DoS attack. (bsc#1244057)\n","status":"published","published":"2025-11-28T09:04:34Z","modified":"2026-02-04T03:28:04.26595Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20229-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\nUpdate to version 2.4.16.\n\nSecurity issues fixed:\n\n- CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).\n- CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).\n- CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference (bsc#1249128).\n- CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).\n\nOther updates and bugfixes:\n\n- Version upgrade to 2.4.16:\n\n  * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,\n    potentially reading past the end of the source string\n    (Issue #1438)\n  * The web interface did not support domain usernames fully\n    (Issue #1441)\n  * Fixed an infinite loop issue in the GTK+ print dialog\n    (Issue #1439 boo#1254353)\n  * Fixed stopping scheduler on unknown directive in\n    configuration (Issue #1443)\n  * Fixed packages for Immutable Mode (jsc#PED-14775\n    from epic jsc#PED-14688)\n\n- Version upgrade to 2.4.15:\n\n  * Fixed potential crash in 'cups-driverd' when there are\n    duplicate PPDs (Issue #1355)\n  * Fixed error recovery when scanning for PPDs\n    in 'cups-driverd' (Issue #1416)\n\n- Version upgrade to 2.4.14.\n\n- Version upgrade to 2.4.13:\n\n  * Added 'print-as-raster' printer and job attributes\n    for forcing rasterization (Issue #1282)\n  * Updated documentation (Issue #1086)\n  * Updated IPP backend to try a sanitized user name if the\n    printer/server does not like the value (Issue #1145)\n  * Updated the scheduler to send the \"printer-added\"\n    or \"printer-modified\" events  whenever an IPP Everywhere PPD\n    is installed (Issue #1244)\n  * Updated the scheduler to send the \"printer-modified\" event\n    whenever the system default printer is changed (Issue #1246)\n  * Fixed a memory leak in 'httpClose' (Issue #1223)\n  * Fixed missing commas in 'ippCreateRequestedArray'\n    (Issue #1234)\n  * Fixed subscription issues in the scheduler and D-Bus notifier\n    (Issue #1235)\n  * Fixed media-default reporting for custom sizes (Issue #1238)\n  * Fixed support for IPP/PPD options with periods or underscores\n    (Issue #1249)\n  * Fixed parsing of real numbers in PPD compiler source files\n    (Issue #1263)\n  * Fixed scheduler freezing with zombie clients (Issue #1264)\n  * Fixed support for the server name in the ErrorLog filename\n    (Issue #1277)\n  * Fixed job cleanup after daemon restart (Issue #1315)\n  * Fixed handling of buggy DYMO USB printer serial numbers\n   (Issue #1338)\n  * Fixed unreachable block in IPP backend (Issue #1351)\n  * Fixed memory leak in _cupsConvertOptions (Issue #1354)\n\n- Version upgrade to 2.4.12:\n\n  * GnuTLS follows system crypto policies now (Issue #1105)\n  * Added `NoSystem` SSLOptions value (Issue #1130)\n  * Now we raise alert for certificate issues (Issue #1194)\n  * Added Kyocera USB quirk (Issue #1198)\n  * The scheduler now logs a job's debugging history\n    if the backend fails (Issue #1205)\n  * Fixed a potential timing issue with `cupsEnumDests`\n    (Issue #1084)\n  * Fixed a potential \"lost PPD\" condition in the scheduler\n    (Issue #1109)\n  * Fixed a compressed file error handling bug (Issue #1070)\n  * Fixed a bug in the make-and-model whitespace trimming\n    code (Issue #1096)\n  * Fixed a removal of IPP Everywhere permanent queue\n    if installation failed (Issue #1102)\n  * Fixed `ServerToken None` in scheduler (Issue #1111)\n  * Fixed invalid IPP keyword values created from PPD\n    option names (Issue #1118)\n  * Fixed handling of \"media\" and \"PageSize\" in the same\n    print request (Issue #1125)\n  * Fixed client raster printing from macOS (Issue #1143)\n  * Fixed the default User-Agent string.\n  * Fixed a recursion issue in `ippReadIO`.\n  * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)\n  * Fixed validation of dateTime values with time zones\n    more than UTC+11 (Issue #1201)\n  * Fixed attributes returned by the Create-Xxx-Subscriptions\n    requests (Issue #1204)\n  * Fixed `ippDateToTime` when using a non GMT/UTC timezone\n    (Issue #1208)\n  * Fixed `job-completed` event notifications for jobs that are\n    cancelled before started (Issue #1209)\n  * Fixed DNS-SD discovery with `ippfind` (Issue #1211)\n","status":"published","published":"2026-02-04T11:40:11Z","modified":"2026-03-23T04:52:45.395564Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20231-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\nUpdate to version 2.4.16.\n\nSecurity issues fixed:\n\n- CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).\n- CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).\n- CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference (bsc#1249128).\n- CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).\n\nOther updates and bugfixes:\n\n- Version upgrade to 2.4.16:\n\n  * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,\n    potentially reading past the end of the source string\n    (Issue #1438)\n  * The web interface did not support domain usernames fully\n    (Issue #1441)\n  * Fixed an infinite loop issue in the GTK+ print dialog\n    (Issue #1439 boo#1254353)\n  * Fixed stopping scheduler on unknown directive in\n    configuration (Issue #1443)\n  * Fixed packages for Immutable Mode (jsc#PED-14775\n    from epic jsc#PED-14688)\n\n- Version upgrade to 2.4.15:\n\n  * Fixed potential crash in 'cups-driverd' when there are\n    duplicate PPDs (Issue #1355)\n  * Fixed error recovery when scanning for PPDs\n    in 'cups-driverd' (Issue #1416)\n\n- Version upgrade to 2.4.14.\n\n- Version upgrade to 2.4.13:\n\n  * Added 'print-as-raster' printer and job attributes\n    for forcing rasterization (Issue #1282)\n  * Updated documentation (Issue #1086)\n  * Updated IPP backend to try a sanitized user name if the\n    printer/server does not like the value (Issue #1145)\n  * Updated the scheduler to send the \"printer-added\"\n    or \"printer-modified\" events  whenever an IPP Everywhere PPD\n    is installed (Issue #1244)\n  * Updated the scheduler to send the \"printer-modified\" event\n    whenever the system default printer is changed (Issue #1246)\n  * Fixed a memory leak in 'httpClose' (Issue #1223)\n  * Fixed missing commas in 'ippCreateRequestedArray'\n    (Issue #1234)\n  * Fixed subscription issues in the scheduler and D-Bus notifier\n    (Issue #1235)\n  * Fixed media-default reporting for custom sizes (Issue #1238)\n  * Fixed support for IPP/PPD options with periods or underscores\n    (Issue #1249)\n  * Fixed parsing of real numbers in PPD compiler source files\n    (Issue #1263)\n  * Fixed scheduler freezing with zombie clients (Issue #1264)\n  * Fixed support for the server name in the ErrorLog filename\n    (Issue #1277)\n  * Fixed job cleanup after daemon restart (Issue #1315)\n  * Fixed handling of buggy DYMO USB printer serial numbers\n   (Issue #1338)\n  * Fixed unreachable block in IPP backend (Issue #1351)\n  * Fixed memory leak in _cupsConvertOptions (Issue #1354)\n\n- Version upgrade to 2.4.12:\n\n  * GnuTLS follows system crypto policies now (Issue #1105)\n  * Added `NoSystem` SSLOptions value (Issue #1130)\n  * Now we raise alert for certificate issues (Issue #1194)\n  * Added Kyocera USB quirk (Issue #1198)\n  * The scheduler now logs a job's debugging history\n    if the backend fails (Issue #1205)\n  * Fixed a potential timing issue with `cupsEnumDests`\n    (Issue #1084)\n  * Fixed a potential \"lost PPD\" condition in the scheduler\n    (Issue #1109)\n  * Fixed a compressed file error handling bug (Issue #1070)\n  * Fixed a bug in the make-and-model whitespace trimming\n    code (Issue #1096)\n  * Fixed a removal of IPP Everywhere permanent queue\n    if installation failed (Issue #1102)\n  * Fixed `ServerToken None` in scheduler (Issue #1111)\n  * Fixed invalid IPP keyword values created from PPD\n    option names (Issue #1118)\n  * Fixed handling of \"media\" and \"PageSize\" in the same\n    print request (Issue #1125)\n  * Fixed client raster printing from macOS (Issue #1143)\n  * Fixed the default User-Agent string.\n  * Fixed a recursion issue in `ippReadIO`.\n  * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)\n  * Fixed validation of dateTime values with time zones\n    more than UTC+11 (Issue #1201)\n  * Fixed attributes returned by the Create-Xxx-Subscriptions\n    requests (Issue #1204)\n  * Fixed `ippDateToTime` when using a non GMT/UTC timezone\n    (Issue #1208)\n  * Fixed `job-completed` event notifications for jobs that are\n    cancelled before started (Issue #1209)\n  * Fixed DNS-SD discovery with `ippfind` (Issue #1211)\n","status":"published","published":"2026-02-04T11:40:11Z","modified":"2026-03-23T04:52:45.456971Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20528-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\nUpdate to version 2.4.16.\n\nSecurity issues fixed:\n\n- CVE-2025-58436: single client sending slow messages to cupsd can delay the application and make it unusable for other\n  clients (bsc#1244057).\n- CVE-2025-58060: authentication bypass with AuthType negotiate (bsc#1249049).\n- CVE-2025-58364: unsafe deserialization and validation of printer attributes can lead to null dereference\n  (bsc#1249128).\n- CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).\n\nOther updates and bugfixes:\n\n- Version upgrade to 2.4.16:\n\n  * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,\n    potentially reading past the end of the source string\n    (Issue #1438)\n  * The web interface did not support domain usernames fully\n    (Issue #1441)\n  * Fixed an infinite loop issue in the GTK+ print dialog\n    (Issue #1439 bsc#1254353)\n  * Fixed stopping scheduler on unknown directive in\n    configuration (Issue #1443)\n  \n- Version upgrade to 2.4.15:\n\n  * Fixed potential crash in 'cups-driverd' when there are\n    duplicate PPDs (Issue #1355)\n  * Fixed error recovery when scanning for PPDs\n    in 'cups-driverd' (Issue #1416)\n  \n- Fix packages for Immutable Mode - cups (jsc#PED-14775,jsc#PED-14688)\n\n- Version upgrade to 2.4.14.\n  \n- Version upgrade to 2.4.13:\n\n  * Added 'print-as-raster' printer and job attributes\n    for forcing rasterization (Issue #1282)\n  * Updated documentation (Issue #1086)\n  * Updated IPP backend to try a sanitized user name if the\n    printer/server does not like the value (Issue #1145)\n  * Updated the scheduler to send the \"printer-added\"\n    or \"printer-modified\" events  whenever an IPP Everywhere PPD\n    is installed (Issue #1244)\n  * Updated the scheduler to send the \"printer-modified\" event\n    whenever the system default printer is changed (Issue #1246)\n  * Fixed a memory leak in 'httpClose' (Issue #1223)\n  * Fixed missing commas in 'ippCreateRequestedArray'\n    (Issue #1234)\n  * Fixed subscription issues in the scheduler and D-Bus notifier\n    (Issue #1235)\n  * Fixed media-default reporting for custom sizes (Issue #1238)\n  * Fixed support for IPP/PPD options with periods or underscores\n    (Issue #1249)\n  * Fixed parsing of real numbers in PPD compiler source files\n    (Issue #1263)\n  * Fixed scheduler freezing with zombie clients (Issue #1264)\n  * Fixed support for the server name in the ErrorLog filename\n    (Issue #1277)\n  * Fixed job cleanup after daemon restart (Issue #1315)\n  * Fixed handling of buggy DYMO USB printer serial numbers\n   (Issue #1338)\n  * Fixed unreachable block in IPP backend (Issue #1351)\n  * Fixed memory leak in _cupsConvertOptions (Issue #1354)\n\n- Version upgrade to 2.4.12:\n  \n  * GnuTLS follows system crypto policies now (Issue #1105)\n  * Added `NoSystem` SSLOptions value (Issue #1130)\n  * Now we raise alert for certificate issues (Issue #1194)\n  * Added Kyocera USB quirk (Issue #1198)\n  * The scheduler now logs a job's debugging history\n    if the backend fails (Issue #1205)\n  * Fixed a potential timing issue with `cupsEnumDests`\n    (Issue #1084)\n  * Fixed a potential \"lost PPD\" condition in the scheduler\n    (Issue #1109)\n  * Fixed a compressed file error handling bug (Issue #1070)\n  * Fixed a bug in the make-and-model whitespace trimming\n    code (Issue #1096)\n  * Fixed a removal of IPP Everywhere permanent queue\n    if installation failed (Issue #1102)\n  * Fixed `ServerToken None` in scheduler (Issue #1111)\n  * Fixed invalid IPP keyword values created from PPD\n    option names (Issue #1118)\n  * Fixed handling of \"media\" and \"PageSize\" in the same\n    print request (Issue #1125)\n  * Fixed client raster printing from macOS (Issue #1143)\n  * Fixed the default User-Agent string.\n  * Fixed a recursion issue in `ippReadIO`.\n  * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)\n  * Fixed validation of dateTime values with time zones\n    more than UTC+11 (Issue #1201)\n  * Fixed attributes returned by the Create-Xxx-Subscriptions\n    requests (Issue #1204)\n  * Fixed `ippDateToTime` when using a non GMT/UTC timezone\n    (Issue #1208)\n  * Fixed `job-completed` event notifications for jobs that are\n    cancelled before started (Issue #1209)\n  * Fixed DNS-SD discovery with `ippfind` (Issue #1211)\n","status":"published","published":"2026-03-02T13:19:17Z","modified":"2026-03-04T22:17:29.500835Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20535-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\nUpdate to version 2.4.16.\n\nSecurity issues fixed:\n\n- CVE-2025-58436: single client sending slow messages to cupsd can delay the application and make it unusable for other\n  clients (bsc#1244057).\n- CVE-2025-58060: authentication bypass with AuthType negotiate (bsc#1249049).\n- CVE-2025-58364: unsafe deserialization and validation of printer attributes can lead to null dereference\n  (bsc#1249128).\n- CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).\n\nOther updates and bugfixes:\n\n- Version upgrade to 2.4.16:\n\n  * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,\n    potentially reading past the end of the source string\n    (Issue #1438)\n  * The web interface did not support domain usernames fully\n    (Issue #1441)\n  * Fixed an infinite loop issue in the GTK+ print dialog\n    (Issue #1439 bsc#1254353)\n  * Fixed stopping scheduler on unknown directive in\n    configuration (Issue #1443)\n  \n- Version upgrade to 2.4.15:\n\n  * Fixed potential crash in 'cups-driverd' when there are\n    duplicate PPDs (Issue #1355)\n  * Fixed error recovery when scanning for PPDs\n    in 'cups-driverd' (Issue #1416)\n  \n- Fix packages for Immutable Mode - cups (jsc#PED-14775,jsc#PED-14688)\n\n- Version upgrade to 2.4.14.\n  \n- Version upgrade to 2.4.13:\n\n  * Added 'print-as-raster' printer and job attributes\n    for forcing rasterization (Issue #1282)\n  * Updated documentation (Issue #1086)\n  * Updated IPP backend to try a sanitized user name if the\n    printer/server does not like the value (Issue #1145)\n  * Updated the scheduler to send the \"printer-added\"\n    or \"printer-modified\" events  whenever an IPP Everywhere PPD\n    is installed (Issue #1244)\n  * Updated the scheduler to send the \"printer-modified\" event\n    whenever the system default printer is changed (Issue #1246)\n  * Fixed a memory leak in 'httpClose' (Issue #1223)\n  * Fixed missing commas in 'ippCreateRequestedArray'\n    (Issue #1234)\n  * Fixed subscription issues in the scheduler and D-Bus notifier\n    (Issue #1235)\n  * Fixed media-default reporting for custom sizes (Issue #1238)\n  * Fixed support for IPP/PPD options with periods or underscores\n    (Issue #1249)\n  * Fixed parsing of real numbers in PPD compiler source files\n    (Issue #1263)\n  * Fixed scheduler freezing with zombie clients (Issue #1264)\n  * Fixed support for the server name in the ErrorLog filename\n    (Issue #1277)\n  * Fixed job cleanup after daemon restart (Issue #1315)\n  * Fixed handling of buggy DYMO USB printer serial numbers\n   (Issue #1338)\n  * Fixed unreachable block in IPP backend (Issue #1351)\n  * Fixed memory leak in _cupsConvertOptions (Issue #1354)\n\n- Version upgrade to 2.4.12:\n  \n  * GnuTLS follows system crypto policies now (Issue #1105)\n  * Added `NoSystem` SSLOptions value (Issue #1130)\n  * Now we raise alert for certificate issues (Issue #1194)\n  * Added Kyocera USB quirk (Issue #1198)\n  * The scheduler now logs a job's debugging history\n    if the backend fails (Issue #1205)\n  * Fixed a potential timing issue with `cupsEnumDests`\n    (Issue #1084)\n  * Fixed a potential \"lost PPD\" condition in the scheduler\n    (Issue #1109)\n  * Fixed a compressed file error handling bug (Issue #1070)\n  * Fixed a bug in the make-and-model whitespace trimming\n    code (Issue #1096)\n  * Fixed a removal of IPP Everywhere permanent queue\n    if installation failed (Issue #1102)\n  * Fixed `ServerToken None` in scheduler (Issue #1111)\n  * Fixed invalid IPP keyword values created from PPD\n    option names (Issue #1118)\n  * Fixed handling of \"media\" and \"PageSize\" in the same\n    print request (Issue #1125)\n  * Fixed client raster printing from macOS (Issue #1143)\n  * Fixed the default User-Agent string.\n  * Fixed a recursion issue in `ippReadIO`.\n  * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)\n  * Fixed validation of dateTime values with time zones\n    more than UTC+11 (Issue #1201)\n  * Fixed attributes returned by the Create-Xxx-Subscriptions\n    requests (Issue #1204)\n  * Fixed `ippDateToTime` when using a non GMT/UTC timezone\n    (Issue #1208)\n  * Fixed `job-completed` event notifications for jobs that are\n    cancelled before started (Issue #1209)\n  * Fixed DNS-SD discovery with `ippfind` (Issue #1211) \n","status":"published","published":"2026-03-02T14:17:19Z","modified":"2026-03-04T22:17:29.306019Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-7897-1","title":"cups vulnerability","description":"It was discovered that CUPS incorrectly handled input from users in the web\nconfiguration settings. An attacker could use this issue to insert\nmalicious configuration options, causing a denial of service or possibly\nexecuting arbitrary code.","status":"published","published":"2025-11-27T15:59:31Z","modified":"2026-06-25T13:32:31.419272073Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}