cups (2.4.16-1ubuntu3) stonking; urgency=medium

  * SECURITY UPDATE: authorization bypass vulnerability
    - debian/patches/CVE-2026-27447-1.patch: The scheduler treated local user
      and group names as case-insensitive. in scheduler/auth.c.
    - debian/patches/CVE-2026-27447-2.patch: Fix cupsd crash if user does not
      exist on server in scheduler/auth.c.
    - debian/patches/CVE-2026-27447-3.patch: Fix unauthenticated print policies
      (Issue #1557) in scheduler/auth.c.
    - CVE-2026-27447
  * SECURITY UPDATE: RSS notifier path traversal issue 
    - debian/patches/CVE-2026-34978.patch: Fix RSS notifier. in notifier/rss.c,
      scheduler/ipp.c.
    - CVE-2026-34978
  * SECURITY UPDATE: heap overflow in building filter option strings
    - debian/patches/CVE-2026-34979-1.patch: Expand allocation of options
      string. in scheduler/job.c.
    - debian/patches/CVE-2026-34979-2.patch: Fix get_options regression (Issue
      #1532) in scheduler/job.c, test/5.5-lp.sh.
    - CVE-2026-34979
  * SECURITY UPDATE: embedded newline issue in print jobs
    - debian/patches/CVE-2026-34980-1.patch: Filter out control characters from
      option values. in scheduler/job.c.
    - debian/patches/CVE-2026-34980-2.patch: Fix filter PPD keyword processing
      (Issue #1562) in scheduler/job.c.
    - CVE-2026-34980
  * SECURITY UPDATE: incorrectly accepts local certificates over the
    loopback interface
    - debian/patches/CVE-2026-34990-1.patch: Don't allow local certificates over
      the loopback interface, drop support for writing to plain files. in
      cups/auth.c, scheduler/auth.c, scheduler/client.c, scheduler/ipp.c,
      scheduler/job.c, test/4.2-cups-printer-ops.test, test/5.1-lpadmin.sh.
    - debian/patches/CVE-2026-34990-2.patch: Fix builds against GSSAPI
      (Kerberos) in cups/auth.c.
    - CVE-2026-34990
  * SECURITY UPDATE: integer underflow in _ppdCreateFromIPP()
    - debian/patches/CVE-2026-39314.patch: Range check job-password-supported.
      in cups/ppd-cache.c.
    - CVE-2026-39314
  * SECURITY UPDATE: use-after-free when temp printers are deleted
    - debian/patches/CVE-2026-39316.patch: Expire per-printer subscriptions
      before deleting. in scheduler/printers.c.
    - CVE-2026-39316
  * SECURITY UPDATE: OOB read via SNMP response
    - debian/patches/CVE-2026-41079.patch: Limit num_bytes for SNMP string
      values. in cups/snmp-private.h, cups/snmp.c.
    - debian/patches/CVE-2026-41079-2.patch: Increase supply name buffer by 1
      byte in backend/snmp-supplies.c.
    - CVE-2026-41079
  * Miscellaneous additional fixes:
    - debian/patches/misc-fix-1.patch: Improve page header validation in
      cupsRasterReadHeader in cups/raster-error.c, cups/raster-stream.c.
    - debian/patches/misc-fix-1-2.patch: Make sure we have room for another
      space in cups/raster-error.c.
    - debian/patches/misc-fix-2.patch: Protect against a driver reporting a
      supply type with a trailing '-'. in scheduler/printers.c.
    - debian/patches/misc-fix-3.patch: Range check cupsBytesPerLine in
      rastertoepson. in filter/rastertoepson.c.
    - debian/patches/misc-fix-4.patch: Sanity check HWResolution when writing
      Apple Raster. in cups/raster-stream.c.
    - debian/patches/misc-fix-5.patch: Protect against deep collection values
      (Issue #1539) in cups/cups-private.h, cups/dest-options.c, cups/encode.c.
    - debian/patches/misc-fix-6.patch: Update processing of LimitRequestBody,
      MaxLogSize, and MaxRequestSize to support full range of file sizes in
      scheduler/conf.c, scheduler/conf.h.
    - debian/patches/misc-fix-6-2.patch: Fix builds on systems that don't define
      OFF_MAX in scheduler/conf.c.
    - debian/patches/misc-fix-7.patch: Fix blank line detection in rastertolabel
      in filter/rastertolabel.c.
    - debian/patches/misc-fix-8.patch: Add buffer size check from CUPS 2.5.x to
      _ippFileReadToken (Issue #1542) in cups/ipp-file.c.
    - debian/patches/misc-fix-9.patch: Fix regression in
      cupsRasterRead/WriteHeader. in cups/raster-stream.c.
  * debian/tests/utils/test-drivers: disable most tests since the security
    update no longer accepts writing to files. Needs to be adapted. Taken
    from 2.4.18-1.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 12 Jun 2026 09:05:13 -0400

cups (2.4.16-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable. (LP: #2130070) Remaining changes:
    - d/p/9100-ppd-cache-add-auto-presets.patch
      Added fully automatic generation of PPD option setting presets to
      be applied depending on the settings of the job IPP attributes
      "print-color-mode", "print-quality", and "print-content-optimize".
      This allows easy control of any printer with only standard IPP
      attributes, as for example from a phone (functionality overtaken
      from cups-filters, not (yet) upstream in CUPS).
    - d/libcups2-dev.install, d/rules
      Use pkgconfig file cups.pc from upstream and not Debian's own file
      of CUPS' pre-pkgconfig era. also use
      "--with-pkgconfpath=/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig" in the
      "./configure" command line therefore.
    - d/local/apparmor-profile
      + In the AppArmor profile allow CUPS to access (/var)/run/snapd.socket
        to allow cupsd to determine which interfaces a snapped client
        is plugging.
      + update for new coreutil paths (LP #2123870)
      + add rule for accessing /etc/paperspecs (LP #2125520)
    - d/control
      + Build-depend on libapparmor-dev, libsnapd-glib-dev, needed for
        Snap mediation.
      + In libcupsimage2 recommend libcupsfilters2 instead of libcupsfilters1.
    - d/rules
      + Added "--enable-snapped-clients" to the "./configure" options to use
        the correct Snap mediation mode for an unsnapped cupsd, like provided
        by this package.
      + In debian/rules updated ./configure arguments from --enable-gnutls to
        --with-tls=gnutls. Now libcups has support for all hash types again,
        especially can provide sha2-256 to PAPPL.
  * Dropped Changes
    - d/p/CVE-2025-58060.patch : patched in upstream version
    - d/p/CVE-2025-58364.patch : patched in upstream version
    - d/p/CVE-2025-61915.patch : patched in upstream version
    - d/rules
      + --with-system-groups='lpadmin root'. This was included in Debian 2.4.1op1-2
        as ='root lpadmin', somehow dropped and inverted in Ubuntu.

 -- John Chittum <john.chittum@canonical.com>  Fri, 05 Dec 2025 12:59:59 -0500

cups (2.4.16-1) unstable; urgency=medium

  * Update to new upstream version 2.4.16.
    (Closes: #1121751)
    (Closes: #1121895)
    (Closes: #1121660)

 -- Thorsten Alteholz <debian@alteholz.de>  Thu, 04 Dec 2025 12:42:08 +0100

cups (2.4.15-1) unstable; urgency=medium

  * Update to new upstream version 2.4.15.
  * CVE-2025-61915
    Fix various cupsd issues which cause local DoS.
  * CVE-2025-58436
    Fix unresponsive cupsd process caused by slow client.

 -- Thorsten Alteholz <debian@alteholz.de>  Thu, 27 Nov 2025 23:36:01 +0100

cups (2.4.14-1) unstable; urgency=medium

  * Update to new upstream version 2.4.14.
    (Closes: #1106010)
    (Closes: #1109471)
  * debian/rules: enable tests on riscv64 again (Closes: #1107504)
  * drop patch for CVE-2023-32324 (Closes: #1087849)

 -- Thorsten Alteholz <debian@alteholz.de>  Sat, 04 Oct 2025 12:26:19 +0200

cups (2.4.12-0ubuntu4) resolute; urgency=medium

  * SECURITY UPDATE: Local denial-of-service via cupsd.conf update and
    related issues
    - debian/patches/CVE-2025-61915.patch: fix various issues in cupsd in
      conf/cups-files.conf.in, config-scripts/cups-defaults.m4,
      config.h.in, configure, doc/help/man-cups-files.conf.html,
      man/cups-files.conf.5, scheduler/auth.c, scheduler/auth.h,
      scheduler/client.c, scheduler/conf.c, test/run-stp-tests.sh,
      vcnet/config.h, xcode/CUPS.xcodeproj/project.pbxproj, xcode/config.h.
    - CVE-2025-61915

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 01 Dec 2025 09:15:47 -0500

cups (2.4.12-0ubuntu3) questing; urgency=medium

  * debian/local/apparmor-profile:
    - Update for new coreutil paths (LP: #2123870)
    - Add rule for accessing /etc/paperspecs (LP: #2125520)

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 22 Sep 2025 16:44:55 -0700

cups (2.4.12-0ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: authorization bypass
    - d/p/CVE-2025-58060.patch: only allow basic and kerberos authentication
      if it is enabled.
    - CVE-2025-58060
  * SECURITY UPDATE: remote DoS
    - d/p/CVE-2025-58364.patch: fix null dereference in ipp_read_io().
    - CVE-2025-58364

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Fri, 05 Sep 2025 17:13:12 +0200

cups (2.4.12-0ubuntu1) plucky; urgency=medium

  * New upstream bug fix release 2.4.12
    - Another half year worth of bug fixes ...
    - Last 2.4.x upstream release.
  * Refreshed patches.

 -- Till Kamppeter <till.kamppeter@gmail.com>  Tue, 08 Apr 2025 13:27:28 +0200

cups (2.4.11-0ubuntu2) plucky; urgency=medium

  * No-change rebuild for libpaper.

 -- Sudip Mukherjee <sudipm.mukherjee@gmail.com>  Sun, 22 Dec 2024 11:02:49 +0000

cups (2.4.11-0ubuntu1) plucky; urgency=medium

  * New upstream release 2.4.11
    - Includes fix for CVE-2024-47175
    - In both plucky and oracular the build test ("make check") fails
      for CUPS 2.4.10, cupsd instance on port 8631 not starting up, 2.4.11
      fixes this somehow, most probably this is upstream issue #989.
  * Drop 0014-CVE-2024-47175-and-further-hardening.patch, included
    upstream
  * Add the new /usr/lib/systemd/system/system-cups.slice file to
    cups-daemon.install

 -- Till Kamppeter <till.kamppeter@gmail.com>  Mon, 25 Nov 2024 20:34:33 +0100

cups (2.4.10-4) unstable; urgency=medium

  * CVE-2025-58060
    fix authentication bypass with AuthType Negotiate
  * CVE-2025-58364
    fix remote DoS via null dereference

 -- Thorsten Alteholz <debian@alteholz.de>  Sun, 07 Sep 2025 19:45:05 +0200

cups (2.4.10-3) unstable; urgency=medium

  * Fix FTBFS with huge file limit due to testsuite timeouts after
    changes in systemd (Closes: #1073046)

 -- Thorsten Alteholz <debian@alteholz.de>  Sun, 01 Jun 2025 13:45:05 +0200

cups (2.4.10-2ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2089041). Remaining changes:
    - Added "--enable-snapped-clients" to the "./configure" options to use
      the correct Snap mediation mode for an unsnapped cupsd, like provided
      by this package.
    - Use also "--with-system-groups='lpadmin root'" in "./configure" command
      line.
    - In the AppArmor profile allow CUPS to access (/var)/run/snapd.socket
      to allow cupsd to determine which interfaces a snapped client
      is plugging.
    - Build-depend on libapparmor-dev, libsnapd-glib-dev, needed for
      Snap mediation.
    - Added fully automatic generation of PPD option setting presets to
      be applied depending on the settings of the job IPP attributes
      "print-color-mode", "print-quality", and "print-content-optimize".
      This allows easy control of any printer with only standard IPP
      attributes, as for example from a phone (functionality overtaken
      from cups-filters, mot (yet) upstream in CUPS).
    - In debian/rules updated "./configure" arguments from "--enable-gnutls" to
      "--with-tls=gnutls". Now libcups has support for all hash types again,
      especially can provide sha2-256 to PAPPL.
    - Use pkgconfig file cups.pc from upstream and not Debian's own file
      of CUPS' pre-pkgconfig era. also use
      "--with-pkgconfpath=/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig" in the
      "./configure" command line therefore.
  * In libcupsimage2 recommend libcupsfilters2 instead of libcupsfilters1.
  * CVE-2024-35235.patch: Removed, included upstream. (Closes: #1087849)

 -- Alessandro Astone <alessandro.astone@canonical.com>  Tue, 19 Nov 2024 16:20:03 +0100

cups (2.4.10-2) unstable; urgency=medium

  [ Helge Kreutzmann ]
  * Update German man page (2219t)

  [ Thorsten Alteholz ]
  * CVE-2024-47175
    Fix CVE and upstream also added some extra hardening to patch
    - validate URIs, attribute names, and capabilities
      in cups/ppd-cache.c, scheduler/ipp.c
    - sanitize make and model in cups/ppd-cache.c
    - PPDize preset and template names in cups/ppd-cache.c
    - quote PPD localized strings in  cups/ppd-cache.c
    - fix warnings in cups/ppd-cache.c

 -- Thorsten Alteholz <debian@alteholz.de>  Thu, 26 Sep 2024 23:45:05 +0200

cups (2.4.10-1ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: PPD injection issues (LP: #2082335)
    - debian/patches/sec-202409-1.patch: validate URIs, attribute names,
      and capabilities in cups/ppd-cache.c, scheduler/ipp.c.
    - debian/patches/sec-202409-2.patch: sanitize make and model in
      cups/ppd-cache.c.
    - debian/patches/sec-202409-3.patch: PPDize preset and template names
      in cups/ppd-cache.c.
    - debian/patches/sec-202409-4.patch: quote PPD localized strings in
      cups/ppd-cache.c.
    - debian/patches/sec-202409-5.patch: fix warnings in cups/ppd-cache.c.
    - CVE-2024-47175

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 26 Sep 2024 07:14:15 -0400

cups (2.4.10-1ubuntu1) oracular; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Added "--enable-snapped-clients" to the "./configure" options to use
      the correct Snap mediation mode for an unsnapped cupsd, like provided
      by this package.
    - Use also "--with-system-groups='lpadmin root'" in "./configure" command
      line.
    - In the AppArmor profile allow CUPS to access (/var)/run/snapd.socket
      to allow cupsd to determine which interfaces a snapped client
      is plugging.
    - Build-depend on libapparmor-dev, libsnapd-glib-dev, needed for
      Snap mediation.
    - Added fully automatic generation of PPD option setting presets to
      be applied depending on the settings of the job IPP attributes
      "print-color-mode", "print-quality", and "print-content-optimize".
      This allows easy control of any printer with only standard IPP
      attributes, as for example from a phone (functionality overtaken
      from cups-filters, mot (yet) upstream in CUPS).
    - In debian/rules updated "./configure" arguments from "--enable-gnutls" to
      "--with-tls=gnutls". Now libcups has support for all hash types again,
      especially can provide sha2-256 to PAPPL.
    - Use pkgconfig file cups.pc from upstream and not Debian's own file
      of CUPS' pre-pkgconfig era. also use
      "--with-pkgconfpath=/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig" in the
      "./configure" command line therefore.
    - In libcupsimage2 recommend libcupsfilters2 instead of libcupsfilters1.
  * 9100-ppd-cache-add-auto-presets.patch: Updated with quilt.
  * 9110-delay-creating-driverless-printer-until-ppd-generated.patch,
    9120-longer-timeout-for-avahi-resolving-for-cupsgetdests.patch,
    9130-fix-document-unprintable-error-handling.patch,
    CVE-2024-35235.patch,
    fix-scheduler-start-if-only-domain-socket-to-listen.patch: Removed,
    included upstream.

 -- Till Kamppeter <till.kamppeter@gmail.com>  Mon, 12 Aug 2024 15:49:30 +0200

cups (2.4.10-1) unstable; urgency=medium

  * Update to new upstream version 2.4.10.
    (Closes: #1073852) regression of fix for CVE-2024-35235
    (Closes: #1074074) regression of fix for CVE-2024-35235
  * /usr-merge fix (Closes: #1061245)
    (Thanks a lot to Michael Biebl for the MR/patch)

 -- Thorsten Alteholz <debian@alteholz.de>  Sun, 23 Jun 2024 00:42:27 +0200

cups (2.4.7-3) unstable; urgency=medium

  [ Helge Kreutzmann ]
  * Update German man page (2220t)

  [ Thorsten Alteholz ]
  * reintroduce time_t changes that were accidentally deleted
    with last upload
    (thanks to Michael Hudson-Doyle for this work)
  * debian/rules: no test on riscv64 (Closes: #1073046)

 -- Thorsten Alteholz <debian@alteholz.de>  Sat, 15 Jun 2024 22:16:49 +0200

cups (2.4.7-2) unstable; urgency=medium

  * CVE-2024-35235 (Closes: #1073002)
    fix domain socket handling

 -- Thorsten Alteholz <debian@alteholz.de>  Tue, 11 Jun 2024 22:16:49 +0200

cups (2.4.7-1.2ubuntu9) oracular; urgency=medium

  * SECURITY REGRESSION: early exit on missing listen directive
    - d/p/fix-scheduler-start-if-only-domain-socket-to-listen.patch: don't
      exit if no valid Listen or Port found (LP: #2070315) 

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Tue, 02 Jul 2024 17:37:44 +0530

cups (2.4.7-1.2ubuntu8) oracular; urgency=medium

  * SECURITY UPDATE: cupsd listen arbitrary chmod 0140777
    - debian/patches/CVE-2024-35235.patch: validate status of unlink and bind
      in cups/http-addr.c
    - CVE-2024-35235 

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Fri, 21 Jun 2024 15:57:06 +0530

cups (2.4.7-1.2ubuntu7) noble; urgency=low

  * Another fix for crash caused by the fix of the background polling of
    printer capability information in ...ubuntu4. Added also commit 6aeb03b
    from 2.4.x GIT branch to the patch (LP: #2060692, Upstream issue #934,
    pull request #935).

 -- Till Kamppeter <till.kamppeter@gmail.com>  Fri, 12 Apr 2024 22:13:19 +0200

cups (2.4.7-1.2ubuntu6) noble; urgency=low

  * Fix crash caused by the fix of the background polling of printer
    capability information in ...ubuntu4. Added commit 2e65a35 from 2.4.x
    GIT branch to the patch (LP: #2060692, Upstream issue #934, pull
    request #937).
  * Backported upstream commits 939368f from 2.4.x GIT branch, to
    fix the auto-repeating of a job in Raster mode when failed printing
    in PDF mode, due to printer-internal bug/incompatibility (Upstream
    issue #391).

 -- Till Kamppeter <till.kamppeter@gmail.com>  Thu, 11 Apr 2024 23:23:19 +0200

cups (2.4.7-1.2ubuntu5) noble; urgency=low

  * Longer timeout for Avahi resolving for cupsGetDests() API function, used
    by "lpstat -l -e" (Upstream issues #47, #751, fix is already in place
    in the CUPS Snap).

 -- Till Kamppeter <till.kamppeter@gmail.com>  Sat,  6 Apr 2024 00:05:19 +0200

cups (2.4.7-1.2ubuntu4) noble; urgency=low

  * Backported upstream commits 6c6e1b0, ff16dab, and df3718b from 2.4.x GIT
    branch, to
    - Fix race condition due to removal of temporary queue while still accessing
      it. Now timeout clock is reset on every access, temporary queues not
      created if there is a permanent queue to the same printer, temporary queues
      expire after 5 min instead of 1 min (Upstream issue #871).
    - Fix temporary queue appearing as raw queue while CUPS is still polling
      the capability information from the printer. This breaks print dialogs and
      printing itself. Now queue creation is deleayed until the PPD is ready
      (Upstream issue #347).

 -- Till Kamppeter <till.kamppeter@gmail.com>  Fri,  5 Apr 2024 22:48:19 +0200

cups (2.4.7-1.2ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 07:31:09 +0000

cups (2.4.7-1.2ubuntu2) noble; urgency=low

  * Remove Debian's own (broken) cups.pc file, CUPS has it upstreanm from
    2.4.6 on (LP: #2059157).

 -- Till Kamppeter <till.kamppeter@gmail.com>  Tue, 26 Mar 2024 23:17:19 +0100

cups (2.4.7-1.2ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Added "--enable-snapped-clients" to the "./configure" options to use
      the correct Snap mediation mode for an unsnapped cupsd, like provided
      by this package.
    - In the AppArmor profile allow CUPS to access (/var)/run/snapd.socket
      to allow cupsd to determine which interfaces a snapped client
      is plugging.
    - Build-depend on libapparmor-dev, libsnapd-glib-dev, needed for
      Snap mediation.
    - Added fully automatic generation of PPD option setting presets to
      be applied depending on the settings of the job IPP attributes
      "print-color-mode", "print-quality", and "print-content-optimize".
      This allows easy control of any printer with only standard IPP
      attributes, as for example from a phone (functionality overtaken
      from cups-filters, mot (yet) upstream in CUPS).
    - In debian/rules updated ./configure arguments from --enable-gnutls to
      --with-tls=gnutls. Now libcups has support for all hash types again,
      especially can provide sha2-256 to PAPPL.
    - In libcupsimage2 recommend libcupsfilters2 instead of libcupsfilters1.

 -- Till Kamppeter <till.kamppeter@gmail.com>  Tue, 19 Mar 2024 10:46:19 +0100

cups (2.4.7-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.

 -- Michael Hudson-Doyle <mwhudson@debian.org>  Wed, 28 Feb 2024 23:20:02 +0000

cups (2.4.7-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libgnutls30t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 10 Mar 2024 02:03:25 +0000

cups (2.4.7-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Added "--enable-snapped-clients" to the "./configure" options to use
      the correct Snap mediation mode for an unsnapped cupsd, like provided
      by this package.
    - In the AppArmor profile allow CUPS to access (/var)/run/snapd.socket
      to allow cupsd to determine which interfaces a snapped client
      is plugging.
    - Build-depend on libapparmor-dev, libsnapd-glib-dev, needed for
      Snap mediation.
    - Added fully automatic generation of PPD option setting presets to
      be applied depending on the settings of the job IPP attributes
      "print-color-mode", "print-quality", and "print-content-optimize".
      This allows easy control of any printer with only standard IPP
      attributes, as for example from a phone (functionality overtaken
      from cups-filters, mot (yet) upstream in CUPS).
    - In debian/rules updated ./configure arguments from --enable-gnutls to
      --with-tls=gnutls. Now libcups has support for all hash types again,
      especially can provide sha2-256 to PAPPL.
    - In libcupsimage2 recommend libcupsfilters2 instead of libcupsfilters1.
  * Removed patches included upstream:
    - CVE-2023-4504.patch

 -- Till Kamppeter <till.kamppeter@gmail.com>  Wed, 28 Feb 2024 20:07:19 +0100

cups (2.4.7-1) unstable; urgency=medium

  * Update to new upstream version 2.4.7.
    (Closes: #1039983   this should have been fixed in 2.4.3)
    (Closes: #1041466   this should have been fixed in 2.4.3)
    (Closes: #1043331   this should have been fixed in 2.4.3)
    (Closes: #998004    this should have been fixed in 2.4.3)
    (Closes: #1008053   this should have been fixed in 2.4.3)
    (Closes: #1009146   this should have been fixed in 2.4.3)
    (Closes: #1009147   this should have been fixed in 2.4.3)
  * debian/watch: update watch file (Closes: #1043470)
                  (thanks a lot to t3b4in+2gxh764v647us@cs.email)
  * debian/rules: switch on testing again
  * debian/control: bump standard to 4.6.2 (no changes)
  * debian/cups-daemon.NEWS: reword last entry (Closes: #1052419)
                             (thanks to IOhannes m zmoelnig)
  * debian/local/apparmor-profile: add drop-in for cups-pdf as well
                                   (Closes: #954974)
  * Provide a cups.pc file. (Closes: #971625)
    (thanks a lot to Helmut Grohne for the patch)
  * update debian/*.lintian-overrides and use new syntax

 -- Thorsten Alteholz <debian@alteholz.de>  Fri, 06 Oct 2023 20:16:49 +0200

cups (2.4.6-0ubuntu3) mantic; urgency=medium

  * Let pkg-config data file cups.pc get installed into
    /usr/lib/<ARCH>/pkgconfig/
  * Include pkg-config data file cups.pc in libcups2-dev

 -- Till Kamppeter <till.kamppeter@gmail.com>  Tue, 26 Sep 2023 14:56:43 +0200

cups (2.4.6-0ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: Postscript parsing heap overflow
    - debian/patches/CVE-2023-4504.patch: properly check for end of buffer
      in cups/raster-interpret.c.
    - CVE-2023-4504

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 20 Sep 2023 12:42:21 -0400

cups (2.4.6-0ubuntu1) mantic; urgency=medium

  * Update to new upstream version 2.4.6.
    - Fix printing multiple files on specific printers (Upstream issue #643)

 -- Till Kamppeter <till.kamppeter@gmail.com>  Wed, 16 Aug 2023 21:53:43 +0200

cups (2.4.5-0ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: use-after-free in cupsdAcceptClient()
    - debian/patches/CVE-2023-34241.patch: log result of httpGetHostname
      BEFORE closing the connection in scheduler/client.c.
    - CVE-2023-34241

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 22 Jun 2023 12:06:19 -0400

cups (2.4.5-0ubuntu1) mantic; urgency=medium

  * Update to new upstream version 2.4.5.
    - Fixes color printing on printers with "CMYK" choice instead of "RGB"
      in "ColorModel" option of their PPD (Upstream issues #451 and #500,
      LP: 1971242).
  * Merge from Debian unstable. Remaining changes:
    - Added "--enable-snapped-clients" to the "./configure" options to use
      the correct Snap mediation mode for an unsnapped cupsd, like provided
      by this package.
    - In the AppArmor profile allow CUPS to access (/var)/run/snapd.socket
      to allow cupsd to determine which interfaces a snapped client
      is plugging.
    - Build-depend on libapparmor-dev, libsnapd-glib-dev, needed for
      Snap mediation.
    - Added fully automatic generation of PPD option setting presets to
      be applied depending on the settings of the job IPP attributes
      "print-color-mode", "print-quality", and "print-content-optimize".
      This allows easy control of any printer with only standard IPP
      attributes, as for example from a phone (functionality overtaken
      from cups-filters, mot (yet) upstream in CUPS).
    - In debian/rules updated ./configure arguments from --enable-gnutls to
      --with-tls=gnutls. Now libcups has support for all hash types again,
      especially can provide sha2-256 to PAPPL.
    - When polling capabilities of a driverless printer via
      get-printer-attributes IPP request, do a separate poll of the
      media-col-database attribute in case it did not get obtained by the
      first polls.
    - In libcupsimage2 recommend libcupsfilters2 instead of libcupsfilters1.
  * Manually refreshed patch 9100-ppd-cache-add-auto-presets.patch.
  * Removed patches included upstream:
    - 9110-create-local-printer-localhost-fix.patch
    - CVE-2022-26691-2.patch
    - snapd-glib-2.patch
    - poll-media-col-database-separately.patch
    - CVE-2023-32324.patch

 -- Till Kamppeter <till.kamppeter@gmail.com>  Wed, 14 Jun 2023 15:38:00 +0200

cups (2.4.2-6) unstable; urgency=medium

  * CVE-2023-4504
    Postscript parsing heap-based buffer overflow
  * CVE-2023-32360 (Closes: #1051953)
    authentication issue

 -- Thorsten Alteholz <debian@alteholz.de>  Tue, 19 Sep 2023 21:20:27 +0200

cups (2.4.2-5) unstable; urgency=medium

  * CVE-2023-34241 (Closes: #1038885)
    use-after-free in cupsdAcceptClient()

 -- Thorsten Alteholz <debian@alteholz.de>  Wed, 21 Jun 2023 22:30:27 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog cups-common`.
