openSUSE-SU-2026:21850-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21850-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21850-1
Upstream
CVE (6)
Related
CVE (6)
Published
2026-09-14T13:25:38Z
Modified
2026-09-15T18:23:27Z
Summary
Security update for cups-filters
Details

This update for cups-filters fixes the following issues:

Changes in cups-filters:

  • CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field. A user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop. (bsc#1273145,GHSA-rcq7-rv5g-j3r4)

  • CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery) A authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG. (bsc#1273146,GHSA-7mxj-cfq5-84ch)

  • Provide cups-browsed as separated cups-filters-cups-browsed sub-package so users can uninstall this sub-package to completely avoid the generic security risk of cups-browsed. cups-browsed auto-creates local print queues for printers which are announced via DNS-SD. It is a generic security risk when a service (cups-browsed.service) accepts any (possibly malicious) incoming information from any host in the local network (i.e. any DNS-SD announcements) and from that information it auto-creates print queue configurations for CUPS (where its server program cupsd runs as root). For more information see the openSUSE support database article https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

  • Fixed a regression "Error about PPD file during 'driverless' printer setup" (boo#1256868) and "ppd pull out from [driverless] printer feature broken" (bsc#1256977)

  • unbreak qpdf [bsc#1253678]

  • CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939) and to avoid CVE-2024-47850 "cups-browsed can be abused to initiate remote DDoS against third-party targets" (bsc#1231294) by removing legacy CUPS Browsing support in cups-browsed (introduced 2012) which is no longer needed nowadays. CUPS browsing was removed from CUPS since version 1.6. Legacy CUPS Browsing is a generic security risk, see the section "Automated print queue setup via cups-browsed" in https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

  • CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937)

  • CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932)

  • In general regarding CUPS and cups-browsed security issues see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

References

Affected packages

openSUSE:Leap 16.0 / cups-filters

Package

Name
cups-filters
Purl
pkg:rpm/opensuse/cups-filters&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.28.17-bp160.2.1

Ecosystem specific 

{
    "binaries":  [
        {
            "cups-filters":  "1.28.17-bp160.2.1",
            "cups-filters-cups-browsed":  "1.28.17-bp160.2.1",
            "cups-filters-devel":  "1.28.17-bp160.2.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21850-1.json"