Fix CVE-2025-64503, CVE-2025-57812, and CVE-2025-64524 in cups-filters and libcupsfilters

[Douglas R. Reno]

There were two vulnerabilities disclosed on oss-security this morning for libcupsfilters and cups-filters.

• libcupsfilters: CVE-2025-57812 (multiple TIFF-related issues including heap buffer overflows and multiple out-of-bounds reads)
• cups-filters: CVE-2025-64503 (out-of-bounds read in pdftoraster)

More information can be found at ​https://seclists.org/oss-sec/2025/q4/172 and ​https://seclists.org/oss-sec/2025/q4/173

[Joe Locash]

The patches we need for this are both located in the 2.1.x branch of libcupsfilters:

for CVE-2025-57812: ​https://github.com/OpenPrinting/libcupsfilters/commit/ce1174b47948b00818479aba96f8ea23e895fe42

for CVE-2025-64503: ​https://github.com/OpenPrinting/libcupsfilters/commit/c726672e5bfd8b353f18a8c62ce27bc954552c16

[Douglas R. Reno]

Adding CVE-2025-64524 to the list, issued this morning.

Hi all,

we have CVE-2025-64524 in cups-filters project regarding heap buffer overflow in 
rastertopclx reported by frostb1ten.

Since the issue requires user to have additional permissions to install printer with PPD 
file calling rastertopclx filter and the filter is run under lp user which does not have 
root permissions, the vulnerability is Low with CVSS score 3.3 CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:L .

More details in the advisory: https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq44-2q5p-x3hv

Commits with fixes in the project:

master: https://github.com/OpenPrinting/cups-filters/commit/0fe46c511e81062575b05936f804eb18c9f0a011

1.x: https://github.com/OpenPrinting/cups-filters/commit/b03866fd2e251a6d822a5e8c807c8d47b4d2dce2

Have a nice day! 

[Joe Locash]

Fixed at 931dcc38bd.

Leaving open for security advisory.

[Bruce Dubbs]

Reassigning to renodr for security advisories.

[zeckma]

SA-12.4-041 filed.

[Bruce Dubbs]

Milestone renamed