ALT-PU-2026-18812-1

BDU:2026-04785

HIGH7.6

Уязвимость демона cupsd сервера печати CUPS, позволяющая нарушителю выполнить произвольный код

Published: 2026-04-07Modified: 2026-09-21

CVSS 3.xHIGH 7.6

CVSS:3.x/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVSS 2.0HIGH 7.3

CVSS:2.0/AV:A/AC:L/Au:N/C:C/I:P/A:P

References

CVE-2026-105326

LOW2.5

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

Published: 2026-10-05Modified: 2026-10-07

CVSS 3.xLOW 2.5

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-34980

MEDIUM6.1

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.

Published: 2026-04-03Modified: 2026-07-24

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0MEDIUM 6.1

CVSS:4.0/CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

CVE-2026-55453

LOW3.3

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.

Published: 2026-10-15

CVSS 3.xLOW 3.3

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References

CVE-2026-55467

LOW2.5

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

Published: 2026-10-15

CVSS 3.xLOW 2.5

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

CVE-2026-55480

MEDIUM5.7

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

Published: 2026-10-15

CVSS 3.xMEDIUM 5.7

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

References

CVE-2026-61702

MEDIUM5.3

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.

Published: 2026-10-15

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-87875

MEDIUM4.3

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Published: 2026-09-09Modified: 2026-09-11

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-87876

LOW3.0

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Published: 2026-09-09Modified: 2026-09-21

CVSS 3.xLOW 3.0

CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

Package update cups in branch p11_loongarch64

Closed issues (9)

Уязвимость демона cupsd сервера печати CUPS, позволяющая нарушителю выполнить произвольный код

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Closed bugs (1)

Падает в core после обновления