Affected: AlmaLinux:9: cups, AlmaLinux:9: cups-client, AlmaLinux:9: cups-devel, AlmaLinux:9: cups-filesystem, AlmaLinux:9: cups-ipptool, AlmaLinux:9: cups-libs, AlmaLinux:9: cups-lpd, AlmaLinux:9: cups-printerapp

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

* cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS

(CVE-2025-58364)

* cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: cups, Alpaquita:25: cups, Alpaquita:stream: cups

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.

Affected: openEuler:24.03-LTS-SP2: cups, openEuler:20.03-LTS-SP4: cups, openEuler:22.03-LTS-SP3: cups, openEuler:22.03-LTS-SP4: cups, openEuler:24.03-LTS: cups, openEuler:24.03-LTS-SP1: cups

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers. Security Fix(es):

['Hi all,\n\nthere is important security vulnerability in CUPS:\n\n\n\xa0\xa0 Description\n\n\n\xa0\xa0\xa0\xa0 Summary', 'Details', 'PoC\n\n- Configure CUPS with |DefaultAuthType Negotiate|.\n- Start CUPS', '- cat /etc/cups/cupsd.conf\nhaha\n\n\n\xa0\xa0\xa0\xa0 Impact', 'Patch', 'Have a nice day,\n\n\nZdenek Dohnal\n\n--\nZdenek Dohnal\nSenior Software Engineer\nRed Hat, BRQ-TPBC'](CVE-2025-58060)

['Hi all!', 'Description\n\n\n\xa0\xa0\xa0\xa0 Summary', 'Details\n\nThe combination of:', 'Is shown in two places in OpenPrinting:\n\n|cups/scheduler/ipp.c libcupsfilters/cupsfilters/ipp.c |', 'PoC', 'Impact', 'Metrics:\n\n\n\xa0\xa0\xa0\xa0\xa0\xa0 CVSS v3 base metrics\n\nAttack vector Adjacent\nAttack complexity Low\nPrivileges required None\nUser interaction None\nScope Unchanged\nConfidentiality None\nIntegrity None\nAvailability High\n\nCredit -', 'Patch', 'Have a nice day!\n\n\nZdenek\n\n--\nZdenek Dohnal\nSenior Software Engineer\nRed Hat, BRQ-TPBC'](CVE-2025-58364)

cups-2.4.14-1.1 on GA media

cups: Authentication Bypass in CUPS Authorization Handling cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS

Security update for cups

Affected: Ubuntu:Pro:16.04:LTS: cups, Ubuntu:Pro:18.04:LTS: cups, Ubuntu:Pro:20.04:LTS: cups, Ubuntu:22.04:LTS: cups, Ubuntu:24.04:LTS: cups

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.

Ein Angreifer kann mehrere Schwachstellen in CUPS ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.