Affected: AlmaLinux:9: cups, AlmaLinux:9: cups-client, AlmaLinux:9: cups-devel, AlmaLinux:9: cups-filesystem, AlmaLinux:9: cups-ipptool, AlmaLinux:9: cups-libs, AlmaLinux:9: cups-lpd, AlmaLinux:9: cups-printerapp

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

* CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915) * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: cups, Alpaquita:25: cups, Alpaquita:stream: cups

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.

Affected: openEuler:22.03-LTS-SP4: cups

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers. Security Fix(es):

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

cups-2.4.16-1.1 on GA media

cups: CUPS-Filters: Information disclosure and data corruption via crafted TIFF image file processing cups: Authentication Bypass in CUPS Authorization Handling cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS cups: Slow client communication leads to a possible DoS attack cups: cups-filters: cups-filters: Out-of-bounds write via crafted PDF MediaBox cups: OpenPrinting CUPS: Authorization bypass via case-insensitive username comparison cups: OpenPrinting CUPS: Denial of Service via path traversal in RSS notifier cups: OpenPrinting CUPS: Denial of Service via heap-based buffer overflow in job attribute processing cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network cups: OpenPrinting CUPS: Privilege escalation via arbitrary file overwrite due to coerced authentication cups: CUPS: Denial of Service via integer underflow in IPP attribute handling cups: CUPS: Denial of Service and potential arbitrary code execution via use-after-free vulnerability when deleting temporary printers.

Security update for cups

Affected: Ubuntu:Pro:16.04:LTS: cups, Ubuntu:Pro:18.04:LTS: cups, Ubuntu:Pro:20.04:LTS: cups, Ubuntu:22.04:LTS: cups, Ubuntu:24.04:LTS: cups, Ubuntu:25.10: cups

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.

Ein lokaler Angreifer kann mehrere Schwachstellen in CUPS ausnutzen, um einen Denial of Service Angriff durchzuführen.