cups (2.4.1op1-1ubuntu4.21) jammy-security; urgency=medium

  * SECURITY REGRESSION: crash with large printer PPD (LP: #2156339)
    - debian/patches/misc-fix-1-2.patch: Make sure we have room for another
      space in cups/raster-error.c.
    - unknown
  * SECURITY REGRESSION: off-by-one write copying snmp supply names
    - debian/patches/CVE-2026-41079-2.patch: Increase supply name buffer by 1
      byte in backend/snmp-supplies.c.
    - CVE-2026-41079

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 11 Jun 2026 10:50:20 -0400

cups (2.4.1op1-1ubuntu4.20) jammy-security; urgency=medium

  * SECURITY UPDATE: authorization bypass vulnerability
    - debian/patches/CVE-2026-27447-1.patch: The scheduler treated local user
      and group names as case-insensitive. in scheduler/auth.c.
    - debian/patches/CVE-2026-27447-2.patch: Fix cupsd crash if user does not
      exist on server in scheduler/auth.c.
    - debian/patches/CVE-2026-27447-3.patch: Fix unauthenticated print policies
      (Issue #1557) in scheduler/auth.c.
    - CVE-2026-27447
  * SECURITY UPDATE: RSS notifier path traversal issue 
    - debian/patches/CVE-2026-34978.patch: Fix RSS notifier. in notifier/rss.c,
      scheduler/ipp.c.
    - CVE-2026-34978
  * SECURITY UPDATE: heap overflow in building filter option strings
    - debian/patches/CVE-2026-34979-1.patch: Expand allocation of options
      string. in scheduler/job.c.
    - debian/patches/CVE-2026-34979-2.patch: Fix get_options regression (Issue
      #1532) in scheduler/job.c, test/5.5-lp.sh.
    - CVE-2026-34979
  * SECURITY UPDATE: embedded newline issue in print jobs
    - debian/patches/CVE-2026-34980-1.patch: Filter out control characters from
      option values. in scheduler/job.c.
    - debian/patches/CVE-2026-34980-2.patch: Fix filter PPD keyword processing
      (Issue #1562) in scheduler/job.c.
    - CVE-2026-34980
  * SECURITY UPDATE: incorrectly accepts local certificates over the
    loopback interface
    - debian/patches/CVE-2026-34990-1.patch: Don't allow local certificates over
      the loopback interface, drop support for writing to plain files. in
      cups/auth.c, scheduler/auth.c, scheduler/client.c, scheduler/ipp.c,
      scheduler/job.c, test/4.2-cups-printer-ops.test, test/5.1-lpadmin.sh.
    - debian/patches/CVE-2026-34990-2.patch: Fix builds against GSSAPI
      (Kerberos) in cups/auth.c.
    - CVE-2026-34990
  * SECURITY UPDATE: integer underflow in _ppdCreateFromIPP()
    - debian/patches/CVE-2026-39314.patch: Range check job-password-supported.
      in cups/ppd-cache.c.
    - CVE-2026-39314
  * SECURITY UPDATE: use-after-free when temp printers are deleted
    - debian/patches/CVE-2026-39316.patch: Expire per-printer subscriptions
      before deleting. in scheduler/printers.c.
    - CVE-2026-39316
  * SECURITY UPDATE: OOB read via SNMP response
    - debian/patches/CVE-2026-41079.patch: Limit num_bytes for SNMP string
      values. in cups/snmp-private.h, cups/snmp.c.
    - CVE-2026-41079
  * Miscellaneous additional fixes:
    - debian/patches/misc-fix-1.patch: Improve page header validation in
      cupsRasterReadHeader in cups/raster-error.c, cups/raster-stream.c.
    - debian/patches/misc-fix-2.patch: Protect against a driver reporting a
      supply type with a trailing '-'. in scheduler/printers.c.
    - debian/patches/misc-fix-3.patch: Range check cupsBytesPerLine in
      rastertoepson. in filter/rastertoepson.c.
    - debian/patches/misc-fix-4.patch: Sanity check HWResolution when writing
      Apple Raster. in cups/raster-stream.c.
    - debian/patches/misc-fix-5.patch: Protect against deep collection values
      (Issue #1539) in cups/cups-private.h, cups/dest-options.c, cups/encode.c.
    - debian/patches/misc-fix-6.patch: Update processing of LimitRequestBody,
      MaxLogSize, and MaxRequestSize to support full range of file sizes in
      scheduler/conf.c, scheduler/conf.h.
    - debian/patches/misc-fix-6-2.patch: Fix builds on systems that don't define
      OFF_MAX in scheduler/conf.c.
    - debian/patches/misc-fix-7.patch: Fix blank line detection in rastertolabel
      in filter/rastertolabel.c.
    - debian/patches/misc-fix-8.patch: Add buffer size check from CUPS 2.5.x to
      _ippFileReadToken (Issue #1542) in cups/ipp-file.c.
    - debian/patches/misc-fix-9.patch: Fix regression in
      cupsRasterRead/WriteHeader. in cups/raster-stream.c.
  * debian/tests/utils/test-drivers: disable most tests since the security
    update no longer accepts writing to files. Needs to be adapted. Taken
    from 2.4.18-1.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 05 Jun 2026 09:48:04 -0400

cups (2.4.1op1-1ubuntu4.16) jammy-security; urgency=medium

  * SECURITY UPDATE: Slow client communication leads to a possible DoS
    attack
    - debian/patches/CVE-2025-58436-1.patch: fix unresponsive cupsd process
      caused by a slow client in cups/http-private.h, cups/http.c,
      scheduler/client.c, scheduler/client.h, scheduler/select.c.
    - debian/patches/CVE-2025-58436-2.patch: fix an infinite loop issue in
      GTK+ in cups/http.c.
    - CVE-2025-58436
  * SECURITY REGRESSION: issue with invalid configuration (LP: #2133207)
    - debian/patches/lp2133207.patch: fix stopping scheduler on unknown
      directive in scheduler/conf.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 03 Dec 2025 09:44:44 -0500

cups (2.4.1op1-1ubuntu4.15) jammy-security; urgency=medium

  * SECURITY UPDATE: Local denial-of-service via cupsd.conf update and
    related issues
    - debian/patches/CVE-2025-61915.patch: fix various issues in cupsd in
      conf/cups-files.conf.in, config-scripts/cups-defaults.m4,
      config.h.in, configure, doc/help/man-cups-files.conf.html,
      man/cups-files.conf.5, scheduler/auth.c, scheduler/auth.h,
      scheduler/client.c, scheduler/conf.c, test/run-stp-tests.sh,
      vcnet/config.h, xcode/CUPS.xcodeproj/project.pbxproj, xcode/config.h.
    - CVE-2025-61915

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Nov 2025 09:33:06 -0500

cups (2.4.1op1-1ubuntu4.12) jammy-security; urgency=medium

  * SECURITY UPDATE: authorization bypass
    - d/p/CVE-2025-58060.patch: only allow basic and kerberos authentication
      if it is enabled.
    - CVE-2025-58060
  * SECURITY UPDATE: remote DoS
    - d/p/CVE-2025-58364.patch: fix null dereference in ipp_read_io().
    - CVE-2025-58364

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 08 Sep 2025 20:01:49 +0200

cups (2.4.1op1-1ubuntu4.11) jammy-security; urgency=medium

  * SECURITY UPDATE: PPD injection issues (LP: #2082335)
    - debian/patches/sec-202409-1.patch: validate URIs, attribute names,
      and capabilities in cups/ppd-cache.c, scheduler/ipp.c.
    - debian/patches/sec-202409-2.patch: sanitize make and model in
      cups/ppd-cache.c.
    - debian/patches/sec-202409-3.patch: PPDize preset and template names
      in cups/ppd-cache.c.
    - debian/patches/sec-202409-4.patch: quote PPD localized strings in
      cups/ppd-cache.c.
    - debian/patches/sec-202409-5.patch: fix warnings in cups/ppd-cache.c.
    - CVE number pending

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 26 Sep 2024 07:27:55 -0400

cups (2.4.1op1-1ubuntu4.10) jammy-security; urgency=medium

  * SECURITY REGRESSION: early exit on missing listen directive
    - d/p/fix-scheduler-start-if-only-domain-socket-to-listen.patch: don't
      exit if no valid Listen or Port found (LP: #2070315)

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Thu, 27 Jun 2024 19:09:25 +0530

cups (2.4.1op1-1ubuntu4.9) jammy-security; urgency=medium

  * SECURITY UPDATE: cupsd listen arbitrary chmod 0140777
    - debian/patches/CVE-2024-35235.patch: validate status of unlink and bind
      in cups/http-addr.c
    - CVE-2024-35235 

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Fri, 21 Jun 2024 00:32:50 +0530

cups (2.4.1op1-1ubuntu4.8) jammy; urgency=medium

  * The "lpoptions" utility, when run as root was writing into the file
    /root/.cups/lpoptions instread of /etc/cups/lpoptions. System software
    should never write into /root/ (LP: #2052925).

 -- Till Kamppeter <till.kamppeter@gmail.com>  Wed, 14 Feb 2023 14:10:00 +0100

cups (2.4.1op1-1ubuntu4.7) jammy-security; urgency=medium

  * SECURITY UPDATE: Postscript parsing heap overflow
    - debian/patches/CVE-2023-4504.patch: properly check for end of buffer
      in cups/raster-interpret.c.
    - CVE-2023-4504

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 15 Sep 2023 07:19:58 -0400

# For older changelog entries, run 'apt-get changelog cups-common'
