{"schemaVersion":3,"id":"OPENSUSE-SU-2026:21850-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for cups-filters\n\nThis update for cups-filters fixes the following issues:\n\nChanges in cups-filters:\n\n- CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in\n   cfIEEE1284NormalizeMakeModel on empty MDL field.\n  A user who controls an IEEE-1284 device ID consumed by\n   `cfIEEE1284GetMakeModel` can drive\n   `cfIEEE1284NormalizeMakeModel` into an infinite loop.\n  (bsc#1273145,GHSA-rcq7-rv5g-j3r4)\n\n- CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process\n   (missing libpng setjmp recovery)\n  A authenticated client that can submit an image print job\n   can abort the CUPS filter process by supplying a malformed PNG.\n  (bsc#1273146,GHSA-7mxj-cfq5-84ch)\n\n- Provide cups-browsed as separated cups-filters-cups-browsed\n  sub-package so users can uninstall this sub-package\n  to completely avoid the generic security risk of cups-browsed.\n  cups-browsed auto-creates local print queues for printers which\n  are announced via DNS-SD. It is a generic security risk when a\n  service (cups-browsed.service) accepts any (possibly malicious)\n  incoming information from any host in the local network\n  (i.e. any DNS-SD announcements) and from that information\n  it auto-creates print queue configurations for CUPS\n  (where its server program cupsd runs as root).\n  For more information see the openSUSE support database article\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n\n- Fixed a regression \"Error about PPD file during 'driverless' printer setup\"\n  (boo#1256868) and \"ppd pull out from [driverless] printer feature broken\"\n  (bsc#1256977)\n\n- unbreak qpdf [bsc#1253678]\n\n- CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939)\n  and to avoid CVE-2024-47850 \"cups-browsed can be abused to\n  initiate remote DDoS against third-party targets\" (bsc#1231294)\n  by removing legacy CUPS Browsing support in cups-browsed\n  (introduced 2012) which is no longer needed nowadays.\n  CUPS browsing was removed from CUPS since version 1.6.\n  Legacy CUPS Browsing is a generic security risk, see the\n  section \"Automated print queue setup via cups-browsed\" in\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n\n- CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937)\n\n- CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932)\n\n- In general regarding CUPS and cups-browsed security issues see\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings","dates":{"published":"2026-09-14T13:25:38.000Z","modified":"2026-09-15T17:00:06.697Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"cups-filters&distro=openSUSE Leap 16.0","name":"cups-filters","label":"cups-filters&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/cups-filters&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 1.28.17-bp160.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.28.17-bp160.2.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.suse.com/1230932","label":"bugzilla.suse.com/1230932","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1230937","label":"bugzilla.suse.com/1230937","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1230939","label":"bugzilla.suse.com/1230939","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1231294","label":"bugzilla.suse.com/1231294","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1253678","label":"bugzilla.suse.com/1253678","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256868","label":"bugzilla.suse.com/1256868","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1256977","label":"bugzilla.suse.com/1256977","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273145","label":"bugzilla.suse.com/1273145","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273146","label":"bugzilla.suse.com/1273146","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47076","label":"www.suse.com/security/cve/CVE-2024-47076","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47175","label":"www.suse.com/security/cve/CVE-2024-47175","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47176","label":"www.suse.com/security/cve/CVE-2024-47176","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47850","label":"www.suse.com/security/cve/CVE-2024-47850","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64611","label":"www.suse.com/security/cve/CVE-2026-64611","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64612","label":"www.suse.com/security/cve/CVE-2026-64612","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2024-47076","CVE-2024-47175","CVE-2024-47176","CVE-2024-47850","CVE-2026-64611","CVE-2026-64612"],"downstream":[],"duplicates":[],"related":["CVE-2024-47076","CVE-2024-47175","CVE-2024-47176","CVE-2024-47850","CVE-2026-64611","CVE-2026-64612"]},"timeline":[{"kind":"published","date":"2026-09-14T13:25:38.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-15T17:00:06.697Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:46:46.665Z","stale":false,"partial":false}}