Most recent entries from all

fkie_cve-2026-107655

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.

msrc_CVE-2026-107655 — Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

msrc_CVE-2026-107655

OESA-2026-4517 — cups security update

Affected: openEuler:24.03-LTS-SP1: cups

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers. Security Fix(es):

When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker wh…

RHSA-2026:80679 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service

UBUNTU-CVE-2026-107655

Affected: Ubuntu:Pro:16.04:LTS: cups, Ubuntu:Pro:18.04:LTS: cups, Ubuntu:Pro:20.04:LTS: cups, Ubuntu:22.04:LTS: cups, Ubuntu:24.04:LTS: cups, Ubuntu:26.10: cups, Ubuntu:26.04:LTS: cups