OPENSUSE-SU-2026:21850-1: cups-filters&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:21850-1 is a vulnerability in cups-filters&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 14-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for cups-filters This update for cups-filters fixes the following issues: Changes in cups-filters: - CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field. A user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop. (bsc#1273145,GHSA-rcq7-rv5g-j3r4) - CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery) A authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG. (bsc#1273146,GHSA-7mxj-cfq5-84ch) - Provide cups-browsed as separated cups-filters-cups-browsed sub-package so users can uninstall this sub-package to completely avoid the generic security risk of cups-browsed. cups-browsed auto-creates local print queues for printers which are announced via DNS-SD. It is a generic security risk when a service (cups-browsed.service) accepts any (possibly malicious) incoming information from any host in the local network (i.e. any DNS-SD announcements) and from that information it auto-creates print queue configurations for CUPS (where its server program cupsd runs as root). For more information see the openSUSE support database article https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings - Fixed a regression "Error about PPD file during 'driverless' printer setup" (boo#1256868) and "ppd pull out from [driverless] printer feature broken" (bsc#1256977) - unbreak qpdf [bsc#1253678] - CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939) and to avoid CVE-2024-47850 "cups-browsed can be abused to initiate remote DDoS against third-party targets" (bsc#1231294) by removing legacy CUPS Browsing support in cups-browsed (introduced 2012) which is no longer needed nowadays. CUPS browsing was removed from CUPS since version 1.6. Legacy CUPS Browsing is a generic security risk, see the section "Automated print queue setup via cups-browsed" in https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings - CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937) - CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932) - In general regarding CUPS and cups-browsed security issues see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

No weakness data has been published for this record.