{"id":"CVE-2026-64611","aliases":["ALSA-2026:56965","DEBIAN-CVE-2026-64611","EUVD-2026-47973","GHSA-m7r8-8qc5-j4jf","MGASA-2026-0407","RHSA-2026:56965","RLSA-2026:56965","SUSE-SU-2026:23695-1","SUSE-SU-2026:23715-1","SUSE-SU-2026:3918-1","SUSE-SU-2026:3935-1","UBUNTU-CVE-2026-64611","openSUSE-SU-2026:11681-1","openSUSE-SU-2026:11687-1","openSUSE-SU-2026:21818-1","openSUSE-SU-2026:21850-1"],"status":"published","title":"Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0063,"percentile":0.50513,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-835"],"published":"2026-07-23T10:46:49Z","modified":"2026-11-05T22:18:51Z","affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-13.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-3","2.0.0-3+deb13u1","2.1.1-1","2.1.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-3","2.1.1-1","2.1.1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.16-6.4.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-13.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-13.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.58-19.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.76-1","1.1.0-1","1.1.0-1build1","1.3.0-1","1.4.0-1","1.5.0-1","1.6.0-1","1.7.0-1","1.8.1-1","1.8.2-1","1.8.2-2","1.8.2-2ubuntu2","1.8.2-2ubuntu3","1.8.3-2ubuntu1","1.8.3-2ubuntu2","1.8.3-2ubuntu3","1.8.3-2ubuntu3.1","1.8.3-2ubuntu3.4","1.8.3-2ubuntu3.5","1.8.3-2ubuntu3.5+esm1","1.8.3-2ubuntu3.5+esm2","1.8.3-2ubuntu3.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.9-0ubuntu1","1.17.9-1","1.20.0-2","1.20.1-1","1.20.1-1build1","1.20.2-0ubuntu1","1.20.2-0ubuntu2","1.20.2-0ubuntu3","1.20.2-0ubuntu3.1","1.20.2-0ubuntu3.3","1.20.2-0ubuntu3.3+esm1","1.20.2-0ubuntu3.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.11-0ubuntu1","1.25.11-1","1.25.12-1","1.25.13-1","1.26.0-1","1.26.1-1","1.26.2-1","1.27.0-1","1.27.0-2","1.27.1-1","1.27.1-2","1.27.1-3","1.27.2-1","1.27.3-1","1.27.4-1","1.27.4-1ubuntu0.2","1.27.4-1ubuntu0.3","1.27.4-1ubuntu0.4","1.27.4-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.10-2","1.28.11-1","1.28.11-2","1.28.12-1","1.28.13-0ubuntu1","1.28.14-1","1.28.15-0ubuntu1","1.28.15-0ubuntu1.2","1.28.15-0ubuntu1.3","1.28.15-0ubuntu1.4","1.28.15-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-0ubuntu1","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.0-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-0ubuntu1","2.0.0-0ubuntu6","2.0.0-0ubuntu7","2.0.0-0ubuntu7.1","2.0.0-0ubuntu7.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-0ubuntu4","2.0.1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-0ubuntu3","2.0.1-0ubuntu4","2.0.1-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.1-0ubuntu3","2.1.1-0ubuntu4","2.1.1-0ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libcupsfilters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cups-filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-bp160.2.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:56965","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-64611","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502799","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4","tags":["article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64611","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m7r8-8qc5-j4jf"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64612","tags":["report"]},{"url":"https://bugzilla.redhat.com/2502799","tags":["report"]},{"url":"https://bugzilla.redhat.com/2502801","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-56965.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-64611","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0407.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36182","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502801","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56965.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64611","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64612","tags":["advisory"]},{"url":"https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56965","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623695-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273145","tags":["report"]},{"url":"https://bugzilla.suse.com/1273146","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64612","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623715-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263918-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263935-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-64611","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230932","tags":["report"]},{"url":"https://bugzilla.suse.com/1230937","tags":["report"]},{"url":"https://bugzilla.suse.com/1230939","tags":["report"]},{"url":"https://bugzilla.suse.com/1231294","tags":["report"]},{"url":"https://bugzilla.suse.com/1253678","tags":["report"]},{"url":"https://bugzilla.suse.com/1256868","tags":["report"]},{"url":"https://bugzilla.suse.com/1256977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47850","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-64611","title":"Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","status":"published","published":"2026-07-23T10:46:49.957Z","modified":"2026-11-05T22:08:07.782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-47973","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","status":"published","published":"2026-07-23T10:46:49Z","modified":"2026-11-05T22:08:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T23:02:19.769742Z"}],"ghsa":[{"id":"GHSA-m7r8-8qc5-j4jf","title":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an...","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","status":"published","published":"2026-07-23T12:32:23Z","modified":"2026-08-19T15:31:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:10:38.677871Z"}],"nvd":[{"id":"CVE-2026-64611","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","status":"published","published":"2026-07-23T11:16:40.68Z","modified":"2026-11-05T22:18:51.203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-05T23:57:19.370761Z"}],"osv":[{"id":"DEBIAN-CVE-2026-64611","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","status":"published","published":"2026-07-23T11:16:40.68Z","modified":"2026-10-01T03:03:48.069801325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"RHSA-2026:56965","title":"Red Hat Security Advisory: libcupsfilters security update","status":"published","published":"2026-08-20T10:19:58Z","modified":"2026-08-24T10:18:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:56965","title":"Moderate: libcupsfilters security update","description":"Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications.\n\nSecurity Fix(es):\n\n* libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611)\n\n* libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-20T18:07:20.016374Z","modified":"2026-08-20T18:25:50.685468652Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-64611","description":"A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.","status":"published","published":"2026-07-23T11:16:00Z","modified":"2026-10-17T12:56:24.427152332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"ALSA-2026:56965","title":"Moderate: libcupsfilters security update","description":"Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications.  \n\nSecurity Fix(es):  \n\n  * libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611)\n  * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-10-29T11:30:37.552356054Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"MGASA-2026-0407","title":"Updated libcupsfilters \u0026 cups-filters packages fix security vulnerabilities","description":"cpu exhaustion via infinite loop in cfieee1284normalizemakemodel().\n(CVE-2026-64611)\ncups image filter process abort via malformed png. (CVE-2026-64612)\n","status":"published","published":"2026-09-14T16:26:35Z","modified":"2026-09-14T16:30:32.790866418Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11681-1","title":"cups-filters-1.28.17-9.1 on GA media","description":"These are all security issues fixed in the cups-filters-1.28.17-9.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.945469306Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11687-1","title":"libcupsfilters-2.1.1-2.1 on GA media","description":"These are all security issues fixed in the libcupsfilters-2.1.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:04.469063435Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21818-1","title":"Security update for libcupsfilters","description":"This update for libcupsfilters fixes the following issues:\n\n- CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).\n- CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).\n","status":"published","published":"2026-09-09T13:16:45Z","modified":"2026-09-12T18:23:08.040768829Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21850-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issues:\n\nChanges in cups-filters:\n\n- CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in\n   cfIEEE1284NormalizeMakeModel on empty MDL field.\n  A user who controls an IEEE-1284 device ID consumed by\n   `cfIEEE1284GetMakeModel` can drive\n   `cfIEEE1284NormalizeMakeModel` into an infinite loop.\n  (bsc#1273145,GHSA-rcq7-rv5g-j3r4)\n\n- CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process\n   (missing libpng setjmp recovery)\n  A authenticated client that can submit an image print job\n   can abort the CUPS filter process by supplying a malformed PNG.\n  (bsc#1273146,GHSA-7mxj-cfq5-84ch)\n\n- Provide cups-browsed as separated cups-filters-cups-browsed\n  sub-package so users can uninstall this sub-package\n  to completely avoid the generic security risk of cups-browsed.\n  cups-browsed auto-creates local print queues for printers which\n  are announced via DNS-SD. It is a generic security risk when a\n  service (cups-browsed.service) accepts any (possibly malicious)\n  incoming information from any host in the local network\n  (i.e. any DNS-SD announcements) and from that information\n  it auto-creates print queue configurations for CUPS\n  (where its server program cupsd runs as root).\n  For more information see the openSUSE support database article\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n\n- Fixed a regression \"Error about PPD file during 'driverless' printer setup\"\n  (boo#1256868) and \"ppd pull out from [driverless] printer feature broken\"\n  (bsc#1256977)\n\n- unbreak qpdf [bsc#1253678]\n\n- CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939)\n  and to avoid CVE-2024-47850 \"cups-browsed can be abused to\n  initiate remote DDoS against third-party targets\" (bsc#1231294)\n  by removing legacy CUPS Browsing support in cups-browsed\n  (introduced 2012) which is no longer needed nowadays.\n  CUPS browsing was removed from CUPS since version 1.6.\n  Legacy CUPS Browsing is a generic security risk, see the\n  section \"Automated print queue setup via cups-browsed\" in\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n\n- CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937)\n\n- CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932)\n\n- In general regarding CUPS and cups-browsed security issues see\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n","status":"published","published":"2026-09-14T13:25:38Z","modified":"2026-09-15T17:00:06.697828124Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23695-1","title":"Security update for libcupsfilters","description":"This update for libcupsfilters fixes the following issues:\n\n- CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).\n- CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).\n","status":"published","published":"2026-09-09T13:13:20Z","modified":"2026-09-29T18:23:12.290292946Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23715-1","title":"Security update for libcupsfilters","description":"This update for libcupsfilters fixes the following issues:\n\n- CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field (bsc#1273145).\n- CVE-2026-64612: malformed PNG aborts CUPS image filter process (bsc#1273146).\n","status":"published","published":"2026-09-09T13:13:20Z","modified":"2026-09-29T18:23:13.105116386Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3918-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issues:\n\n- CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive\n  `cfIEEE1284NormalizeMakeModel` into an infinite loop (bsc#1273145).\n- CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying\n  a malformed PNG (bsc#1273146).\n","status":"published","published":"2026-09-01T14:58:38Z","modified":"2026-09-10T18:23:21.264660866Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3935-1","title":"Security update for cups-filters","description":"This update for cups-filters fixes the following issues:\n\n- CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive\n  `cfIEEE1284NormalizeMakeModel` into an infinite loop (bsc#1273145).\n- CVE-2026-64612: authenticated client that can submit an image print job can abort the CUPS filter process by supplying\n  a malformed PNG (bsc#1273146).\n","status":"published","published":"2026-09-03T07:24:46Z","modified":"2026-09-10T18:23:45.607806632Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}