Find a vulnerability
Search criteria
Related vulnerabilities
OESA-2026-4517 (CVE-2025-55480)
Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source websiteCUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.
Security Fix(es):
When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.(CVE-2026-55467)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"cups-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-client-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-debuginfo-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-debugsource-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-devel-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-ipptool-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-libs-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-lpd-2.4.7-18.oe2403sp1.aarch64.rpm",
"cups-printerapp-2.4.7-18.oe2403sp1.aarch64.rpm"
],
"noarch": [
"cups-filesystem-2.4.7-18.oe2403sp1.noarch.rpm",
"cups-help-2.4.7-18.oe2403sp1.noarch.rpm"
],
"src": [
"cups-2.4.7-18.oe2403sp1.src.rpm"
],
"x86_64": [
"cups-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-client-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-debuginfo-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-debugsource-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-devel-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-ipptool-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-libs-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-lpd-2.4.7-18.oe2403sp1.x86_64.rpm",
"cups-printerapp-2.4.7-18.oe2403sp1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP1",
"name": "cups",
"purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-24.03-LTS-SP1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.7-18.oe2403sp1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX\u00ae-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nWhen a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number\u0026gt;.ppd, where con-\u0026gt;number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) \u2014 without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the\npredicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp \u2192 root arbitrary-file-write primitive. The codebase\u0026apos;s own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)\n\nAn argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \u0026quot;-\u0026quot; to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)\n\nA flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)\n\nOpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)\n\nOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass-\u0026gt;printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.(CVE-2026-55467)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler\u0026apos;s filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)",
"id": "OESA-2026-4517",
"modified": "2026-10-22T14:36:05Z",
"published": "2026-10-22T14:36:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4517"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55480"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105326"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107655"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107885"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107886"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107888"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107890"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55467"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61702"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "cups security update",
"upstream": [
"CVE-2025-55480",
"CVE-2026-105326",
"CVE-2026-107655",
"CVE-2026-107885",
"CVE-2026-107886",
"CVE-2026-107888",
"CVE-2026-107890",
"CVE-2026-55453",
"CVE-2026-55467",
"CVE-2026-61702"
]
}
OESA-2026-4518 (CVE-2025-55480)
Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source websiteCUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.
Security Fix(es):
When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.(CVE-2026-55467)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"cups-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-client-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-debuginfo-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-debugsource-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-devel-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-ipptool-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-libs-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-lpd-2.4.7-20.oe2403sp3.aarch64.rpm",
"cups-printerapp-2.4.7-20.oe2403sp3.aarch64.rpm"
],
"noarch": [
"cups-filesystem-2.4.7-20.oe2403sp3.noarch.rpm",
"cups-help-2.4.7-20.oe2403sp3.noarch.rpm"
],
"src": [
"cups-2.4.7-20.oe2403sp3.src.rpm"
],
"x86_64": [
"cups-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-client-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-debuginfo-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-debugsource-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-devel-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-ipptool-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-libs-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-lpd-2.4.7-20.oe2403sp3.x86_64.rpm",
"cups-printerapp-2.4.7-20.oe2403sp3.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP3",
"name": "cups",
"purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-24.03-LTS-SP3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.7-20.oe2403sp3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX\u00ae-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nWhen a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number\u0026gt;.ppd, where con-\u0026gt;number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) \u2014 without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the\npredicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp \u2192 root arbitrary-file-write primitive. The codebase\u0026apos;s own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)\n\nAn argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \u0026quot;-\u0026quot; to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)\n\nA flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)\n\nOpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)\n\nOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass-\u0026gt;printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.(CVE-2026-55467)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler\u0026apos;s filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)",
"id": "OESA-2026-4518",
"modified": "2026-10-22T14:36:06Z",
"published": "2026-10-22T14:36:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4518"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55480"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105326"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107655"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107885"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107886"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107888"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107890"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55467"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61702"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "cups security update",
"upstream": [
"CVE-2025-55480",
"CVE-2026-105326",
"CVE-2026-107655",
"CVE-2026-107885",
"CVE-2026-107886",
"CVE-2026-107888",
"CVE-2026-107890",
"CVE-2026-55453",
"CVE-2026-55467",
"CVE-2026-61702"
]
}
OESA-2026-4519 (CVE-2025-55480)
Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source websiteCUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.
Security Fix(es):
When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.(CVE-2026-55467)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"cups-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-client-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-debuginfo-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-debugsource-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-devel-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-ipptool-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-libs-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-lpd-2.4.7-20.oe2403sp4.aarch64.rpm",
"cups-printerapp-2.4.7-20.oe2403sp4.aarch64.rpm"
],
"noarch": [
"cups-filesystem-2.4.7-20.oe2403sp4.noarch.rpm",
"cups-help-2.4.7-20.oe2403sp4.noarch.rpm"
],
"src": [
"cups-2.4.7-20.oe2403sp4.src.rpm"
],
"x86_64": [
"cups-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-client-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-debuginfo-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-debugsource-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-devel-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-ipptool-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-libs-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-lpd-2.4.7-20.oe2403sp4.x86_64.rpm",
"cups-printerapp-2.4.7-20.oe2403sp4.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP4",
"name": "cups",
"purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-24.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.7-20.oe2403sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX\u00ae-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nWhen a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number\u0026gt;.ppd, where con-\u0026gt;number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) \u2014 without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the\npredicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp \u2192 root arbitrary-file-write primitive. The codebase\u0026apos;s own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)\n\nAn argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \u0026quot;-\u0026quot; to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)\n\nA flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)\n\nOpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)\n\nOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass-\u0026gt;printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.(CVE-2026-55467)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler\u0026apos;s filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)",
"id": "OESA-2026-4519",
"modified": "2026-10-22T14:36:06Z",
"published": "2026-10-22T14:36:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4519"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55480"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105326"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107655"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107885"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107886"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107888"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107890"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55467"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61702"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "cups security update",
"upstream": [
"CVE-2025-55480",
"CVE-2026-105326",
"CVE-2026-107655",
"CVE-2026-107885",
"CVE-2026-107886",
"CVE-2026-107888",
"CVE-2026-107890",
"CVE-2026-55453",
"CVE-2026-55467",
"CVE-2026-61702"
]
}
OESA-2026-4520 (CVE-2025-55480)
Vulnerability from osv_openeuler – Published: 2026-10-22 14:36 – Updated: 2026-10-22 14:36 – Source websiteCUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.
Security Fix(es):
When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)
| URL | Type | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"cups-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-client-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-debuginfo-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-debugsource-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-devel-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-ipptool-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-libs-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-lpd-2.4.0-25.oe2203sp4.aarch64.rpm",
"cups-printerapp-2.4.0-25.oe2203sp4.aarch64.rpm"
],
"noarch": [
"cups-filesystem-2.4.0-25.oe2203sp4.noarch.rpm",
"cups-help-2.4.0-25.oe2203sp4.noarch.rpm"
],
"src": [
"cups-2.4.0-25.oe2203sp4.src.rpm"
],
"x86_64": [
"cups-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-client-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-debuginfo-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-debugsource-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-devel-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-ipptool-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-libs-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-lpd-2.4.0-25.oe2203sp4.x86_64.rpm",
"cups-printerapp-2.4.0-25.oe2203sp4.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS-SP4",
"name": "cups",
"purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-22.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0-25.oe2203sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX\u00ae-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nWhen a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number\u0026gt;.ppd, where con-\u0026gt;number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) \u2014 without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the\npredicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp \u2192 root arbitrary-file-write primitive. The codebase\u0026apos;s own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)\n\nAn argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \u0026quot;-\u0026quot; to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)\n\nA flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)\n\nOpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)\n\nOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass-\u0026gt;printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.(CVE-2026-107888)\n\nOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.(CVE-2026-107890)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.(CVE-2026-55453)\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler\u0026apos;s filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.(CVE-2026-61702)",
"id": "OESA-2026-4520",
"modified": "2026-10-22T14:36:07Z",
"published": "2026-10-22T14:36:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4520"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55480"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105326"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107655"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107885"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107886"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107888"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107890"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61702"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "cups security update",
"upstream": [
"CVE-2025-55480",
"CVE-2026-105326",
"CVE-2026-107655",
"CVE-2026-107885",
"CVE-2026-107886",
"CVE-2026-107888",
"CVE-2026-107890",
"CVE-2026-55453",
"CVE-2026-61702"
]
}
OPENSUSE-SU-2026:12192-1
Vulnerability from csaf_opensuse - Published: 2026-10-20 00:00 - Updated: 2026-10-21 11:52UBUNTU-CVE-2025-55480 (CVE-2025-55480)
Vulnerability from osv_ubuntu – Published: 2026-10-12 00:00 – Updated: 2026-10-17 09:36 – Source website{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-browsed",
"binary_version": "1.8.3-2ubuntu3.5+esm3"
},
{
"binary_name": "cups-filters",
"binary_version": "1.8.3-2ubuntu3.5+esm3"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "1.8.3-2ubuntu3.5+esm3"
},
{
"binary_name": "libcupsfilters1",
"binary_version": "1.8.3-2ubuntu3.5+esm3"
},
{
"binary_name": "libfontembed1",
"binary_version": "1.8.3-2ubuntu3.5+esm3"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@1.8.3-2ubuntu3.5+esm3?arch=source\u0026distro=esm-infra/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.76-1",
"1.1.0-1",
"1.1.0-1build1",
"1.3.0-1",
"1.4.0-1",
"1.5.0-1",
"1.6.0-1",
"1.7.0-1",
"1.8.1-1",
"1.8.2-1",
"1.8.2-2",
"1.8.2-2ubuntu2",
"1.8.2-2ubuntu3",
"1.8.3-2ubuntu1",
"1.8.3-2ubuntu2",
"1.8.3-2ubuntu3",
"1.8.3-2ubuntu3.1",
"1.8.3-2ubuntu3.4",
"1.8.3-2ubuntu3.5",
"1.8.3-2ubuntu3.5+esm1",
"1.8.3-2ubuntu3.5+esm2",
"1.8.3-2ubuntu3.5+esm3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-browsed",
"binary_version": "1.20.2-0ubuntu3.3+esm2"
},
{
"binary_name": "cups-filters",
"binary_version": "1.20.2-0ubuntu3.3+esm2"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "1.20.2-0ubuntu3.3+esm2"
},
{
"binary_name": "libcupsfilters1",
"binary_version": "1.20.2-0ubuntu3.3+esm2"
},
{
"binary_name": "libfontembed1",
"binary_version": "1.20.2-0ubuntu3.3+esm2"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@1.20.2-0ubuntu3.3+esm2?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.17.9-0ubuntu1",
"1.17.9-1",
"1.20.0-2",
"1.20.1-1",
"1.20.1-1build1",
"1.20.2-0ubuntu1",
"1.20.2-0ubuntu2",
"1.20.2-0ubuntu3",
"1.20.2-0ubuntu3.1",
"1.20.2-0ubuntu3.3",
"1.20.2-0ubuntu3.3+esm1",
"1.20.2-0ubuntu3.3+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-browsed",
"binary_version": "1.27.4-1ubuntu0.4+esm1"
},
{
"binary_name": "cups-filters",
"binary_version": "1.27.4-1ubuntu0.4+esm1"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "1.27.4-1ubuntu0.4+esm1"
},
{
"binary_name": "libcupsfilters1",
"binary_version": "1.27.4-1ubuntu0.4+esm1"
},
{
"binary_name": "libfontembed1",
"binary_version": "1.27.4-1ubuntu0.4+esm1"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@1.27.4-1ubuntu0.4+esm1?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.25.11-0ubuntu1",
"1.25.11-1",
"1.25.12-1",
"1.25.13-1",
"1.26.0-1",
"1.26.1-1",
"1.26.2-1",
"1.27.0-1",
"1.27.0-2",
"1.27.1-1",
"1.27.1-2",
"1.27.1-3",
"1.27.2-1",
"1.27.3-1",
"1.27.4-1",
"1.27.4-1ubuntu0.2",
"1.27.4-1ubuntu0.3",
"1.27.4-1ubuntu0.4",
"1.27.4-1ubuntu0.4+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-browsed",
"binary_version": "1.28.15-0ubuntu1.5"
},
{
"binary_name": "cups-filters",
"binary_version": "1.28.15-0ubuntu1.5"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "1.28.15-0ubuntu1.5"
},
{
"binary_name": "libcupsfilters1",
"binary_version": "1.28.15-0ubuntu1.5"
},
{
"binary_name": "libfontembed1",
"binary_version": "1.28.15-0ubuntu1.5"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@1.28.15-0ubuntu1.5?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.28.10-2",
"1.28.11-1",
"1.28.11-2",
"1.28.12-1",
"1.28.13-0ubuntu1",
"1.28.14-1",
"1.28.15-0ubuntu1",
"1.28.15-0ubuntu1.2",
"1.28.15-0ubuntu1.3",
"1.28.15-0ubuntu1.4",
"1.28.15-0ubuntu1.5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-filters",
"binary_version": "2.0.0-0ubuntu4.1"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "2.0.0-0ubuntu4.1"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@2.0.0-0ubuntu4.1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0-0ubuntu1",
"2.0.0-0ubuntu3",
"2.0.0-0ubuntu4",
"2.0.0-0ubuntu4.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcupsfilters-tests",
"binary_version": "2.0.0-0ubuntu7.2"
},
{
"binary_name": "libcupsfilters2-common",
"binary_version": "2.0.0-0ubuntu7.2"
},
{
"binary_name": "libcupsfilters2t64",
"binary_version": "2.0.0-0ubuntu7.2"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "libcupsfilters",
"purl": "pkg:deb/ubuntu/libcupsfilters@2.0.0-0ubuntu7.2?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0-0ubuntu1",
"2.0.0-0ubuntu6",
"2.0.0-0ubuntu7",
"2.0.0-0ubuntu7.1",
"2.0.0-0ubuntu7.2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-filters",
"binary_version": "2.0.1-0ubuntu5"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "2.0.1-0ubuntu5"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:26.10",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@2.0.1-0ubuntu5?arch=source\u0026distro=stonking"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.1-0ubuntu4",
"2.0.1-0ubuntu5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcupsfilters-tests",
"binary_version": "2.1.1-0ubuntu5"
},
{
"binary_name": "libcupsfilters2-common",
"binary_version": "2.1.1-0ubuntu5"
},
{
"binary_name": "libcupsfilters2t64",
"binary_version": "2.1.1-0ubuntu5"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:26.10",
"name": "libcupsfilters",
"purl": "pkg:deb/ubuntu/libcupsfilters@2.1.1-0ubuntu5?arch=source\u0026distro=stonking"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.1.1-0ubuntu5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "cups-filters",
"binary_version": "2.0.1-0ubuntu4.1"
},
{
"binary_name": "cups-filters-core-drivers",
"binary_version": "2.0.1-0ubuntu4.1"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "cups-filters",
"purl": "pkg:deb/ubuntu/cups-filters@2.0.1-0ubuntu4.1?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.1-0ubuntu3",
"2.0.1-0ubuntu4",
"2.0.1-0ubuntu4.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcupsfilters-tests",
"binary_version": "2.1.1-0ubuntu5"
},
{
"binary_name": "libcupsfilters2-common",
"binary_version": "2.1.1-0ubuntu5"
},
{
"binary_name": "libcupsfilters2t64",
"binary_version": "2.1.1-0ubuntu5"
}
],
"priority_reason": "Potential CUPS-related vulnerability; CUPS is installed by default on Ubuntu desktop and may be network-exposed, so impact needs verification."
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "libcupsfilters",
"purl": "pkg:deb/ubuntu/libcupsfilters@2.1.1-0ubuntu5?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.1.1-0ubuntu3",
"2.1.1-0ubuntu4",
"2.1.1-0ubuntu5"
]
}
],
"aliases": [],
"details": "",
"id": "UBUNTU-CVE-2025-55480",
"modified": "2026-10-17T09:36:20Z",
"published": "2026-10-12T00:00:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-55480"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55480"
},
{
"type": "REPORT",
"url": "docs.bell-sw.com/security/cves/cve-2025-55480"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2025-55480"
]
}