Your message dated Sun, 19 Apr 2026 18:05:21 +0000
with message-id <[email protected]>
and subject line Bug#1133184: fixed in cups 2.4.17-1
has caused the Debian Bug report #1133184,
regarding cups: CVE-2026-39314
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1133184: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133184
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: cups
Version: 2.4.16-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for cups.
CVE-2026-39314[0]:
| OpenPrinting CUPS is an open source printing system for Linux and
| other Unix-like operating systems. In versions 2.4.16 and prior, an
| integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-
| cache.c) allows any unprivileged local user to crash the cupsd root
| process by supplying a negative job-password-supported IPP
| attribute. The bounds check only caps the upper bound, so a negative
| value passes validation, is cast to size_t (wrapping to ~2^64), and
| is used as the length argument to memset() on a 33-byte stack
| buffer. This causes an immediate SIGSEGV in the cupsd root process.
| Combined with systemd's Restart=on-failure, an attacker can repeat
| the crash for sustained denial of service.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-39314
https://www.cve.org/CVERecord?id=CVE-2026-39314
[1] https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7
[2]
https://github.com/OpenPrinting/cups/commit/928a86b1b794f738f0a3dc87561b2e054bff7ce4
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: cups
Source-Version: 2.4.17-1
Done: Thorsten Alteholz <[email protected]>
We believe that the bug you reported is fixed in the latest version of
cups, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thorsten Alteholz <[email protected]> (supplier of updated cups package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 18 Apr 2026 10:46:38 +0200
Source: cups
Architecture: source
Version: 2.4.17-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Printing Team <[email protected]>
Changed-By: Thorsten Alteholz <[email protected]>
Closes: 1060378 1066044 1096002 1100755 1107877 1117347 1121563 1125990 1129212
1131868 1132502 1132716 1132961 1133183 1133184
Changes:
cups (2.4.17-1) unstable; urgency=medium
.
[ Helge Kreutzmann ]
* Update German man page (2229t). Closes: #1117347, #1121563
.
[ Thorsten Alteholz ]
* Update to new upstream version 2.4.17.
* CVE-2026-39314 (Closes: #1133184)
fix integer underflow in `_ppdCreateFromIPP` causes root cupsd crash
via negative `job-password-supported`
* CVE-2026-39316 (Closes: #1133183)
fix use-after-free in `cupsdDeleteTemporaryPrinters` via dangling
subscription pointer
* CVE-2026-34990 (Closes: #1132716)
fix local print admin token disclosure using temporary printers
* CVE-2026-34980 (Closes: #1132716)
fix shared PostScript queue lets anonymous Print-Job requests
reach `lp` code execution over the network
* CVE-2026-34979 (Closes: #1132716)
fix heap overflow in `get_options()`
* CVE-2026-34978 (Closes: #1132716)
fix path traversal in RSS notify-recipient-uri enables file write outside
CacheDir/rss (and clobbering of job.cache)
* CVE-2026-27447 (Closes: #1132716)
fix authorization bypass via case-insensitive group-member lookup
* no known CVE yet, requested from Github
fix heap out-of-bounds read in SNMP supply-level polling leaks
stack memory to authenticated users
* debian/*links: adapt path to libcups2t64 (Closes: #1066044)
* debian/local/apparmor-profile:
- allow read access to /etc/shells (Closes: #1107877)
- allow read access to / (Closes: #1129212)
(Closes: #1132502)
(Closes: #1125990)
- allow read access to /etc/paperspecs (Closes: #1096002)
(Closes: #1131868)
(Closes: #1100755)
- allow read access to /etc/magic (Closes: #1100755)
- add capability net_admin (Closes: #1132961)
(Closes: #1060378)
- Thanks a lot to everybody who helped debugging these issues!
* Thanks to Vincent Blut and Jérémy Lal who provided merge requests
on salsa to one or the other issue above.
* group lpadmin is now handled by systemd-sysusers
(thanks to Luca Boccassi for adding this)
Checksums-Sha1:
996efa8f1e85ebe2d3bcf7adbcf10d36c2fbe2e0 3445 cups_2.4.17-1.dsc
df7b18ec92ffcd48e598b60d4501f2dc8a6eb9f6 8161554 cups_2.4.17.orig.tar.gz
bb14edc8a0c8314a43cc08b2f8ee5ce2b7a77239 228 cups_2.4.17.orig.tar.gz.asc
be22834d1f846164bae73acb0fde0057050fff58 387924 cups_2.4.17-1.debian.tar.xz
28e7ee9583aaf68c196ddb0d8df883c37ce79464 13693 cups_2.4.17-1_amd64.buildinfo
Checksums-Sha256:
4c879c6e1ea5fdce491a78f9e8ed1fb6fd7c5f5534b0d6c3cf9902522c58631d 3445
cups_2.4.17-1.dsc
89c703238de210d4f4f4e5d4269e3d60c4b2f487aad75a8a1eaecd659e4d0b77 8161554
cups_2.4.17.orig.tar.gz
d17416aae8a630bd048839422d35d2e7649c8df2a75348b911315e3b09236bdc 228
cups_2.4.17.orig.tar.gz.asc
3b43a7d1ef84dfa2a96ffd2491b86fa96d09306a82b7d979387f1fb3963c1759 387924
cups_2.4.17-1.debian.tar.xz
abde7de345e1106c9701a68ac7869ee9362a578663f0ed9a880e855644f57dd2 13693
cups_2.4.17-1_amd64.buildinfo
Files:
4e443e7433107a1db7999e187b1d08fb 3445 net optional cups_2.4.17-1.dsc
173b05aaa9f7aac593934ae452aa56b3 8161554 net optional cups_2.4.17.orig.tar.gz
e179855035fea6c780ab511e10530488 228 net optional cups_2.4.17.orig.tar.gz.asc
a2a2d4425f9243e6b79c23036f50b7eb 387924 net optional
cups_2.4.17-1.debian.tar.xz
07a278aa36e6e5fb3bfb3f121820883b 13693 net optional
cups_2.4.17-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmnlFTJfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR+GiD/wNK/pkf3HolYXkk2Yea59LYYr4HZ3Z
grVyWlyChum5Vt/QYtl1/1jnzX35oHsK4fEMRRRkQQQFdxAlePgLZ5c9N2/10jPG
cq20KChuPDk/vSe0eatMQa3BowFoAhSE3alSYshzuJRK4Czf+Guwq4gL551sTsGF
C2bMo6TxYWHCtiZSDesYOmdMc1qlAWbYdY8bSzX31pKfgXVnDqBSYt6ifv2gKK44
0H0esnU6c4IU3QHX7iDsS5K34GLJfUbIRYrSBCgXhgMUJMskYtu6Za/OJkQhnYCa
6xFf0f4llbDVqhz0jE/Gz2mThvyIWTuZIdXLyjtl+TVglXB6cdOrsC6AhplS5IDb
B0zVQo/KxWa9dXbp+cDc06uARvkWiUWWBK0DBaKRB7MeXP3xEUKROpgiU0hdBgCZ
lVfDkjL1IRCejBTJA6mDtfcxcRkN2jzNlP25/AIh/N2xeB1OEZQlyoAsLtsDfXyI
fRO/uP5m765AlHW/P+15LLWWOk+99Y5PizHjWPfMBnizzm6FF4mZGE29N7B+mJ1p
r0MGwKWLZffNuGQgSfDYpeNWuTl4Kd0ge5c8Yyion+Z9gm/KzSbVzsJmuTi0zV3y
pFOdj3X4Yu0GzvoY+t/5zmXSvj+6rNzcsbF1LolZOfnw3rupmsRe6+mpDWnwl49R
RmRtuJo36TkiKQ==
=vKnf
-----END PGP SIGNATURE-----
pgp36RbdwGQwM.pgp
Description: PGP signature
--- End Message ---
