Opened 10 months ago

Closed 10 months ago

Last modified 8 months ago

#22443 closed enhancement (fixed)

Fix CVE-2025-58436 and CVE-2025-61915 in cups. Also cups-2.4.15.

Reported by: Joe Locash Owned by: zeckma
Priority: elevated Milestone: 13.0
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

Both rated as moderate.

Advisories:

​https://github.com/OpenPrinting/cups/security/advisories/GHSA-8wpw-vfgm-qrrr

​https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc

Change History (9)

comment:1 by Joe Locash, 10 months ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:2 by Joe Locash, 10 months ago

Fixed at b6bf125529.

Leaving open for security advisory.

comment:3 by zeckma, 10 months ago

Owner: changed from Joe Locash to zeckma
Status: assigned → new

I'll handle the SA.

Last edited 10 months ago by zeckma (previous) (diff)

comment:4 by zeckma, 10 months ago

Status: new → assigned

comment:5 by Bruce Dubbs, 10 months ago

Summary: Fix CVE-2025-58436 and CVE-2025-61915 in cups → Fix CVE-2025-58436 and CVE-2025-61915 in cups. Also cups-2.4.15.

Note that this ticket masked the new version of cups: cups-2.4.15

comment:6 by Joe Locash, 10 months ago 

Changes in CUPS v2.4.15 (2025-11-27)
------------------------------------

- Fix various cupsd issues which cause local DoS (CVE-2025-61915)
- Fix unresponsive cupsd process caused by slow client (CVE-2025-58436)
- Fixed potential crash in `cups-driverd` when there are duplicate PPDs
  (Issue #1355)
- Fixed error recovery when scanning for PPDs in `cups-driverd` (Issue #1416)

comment:7 by Joe Locash, 10 months ago

cups updated to 2.4.15 at 9558d84ef5.

comment:8 by zeckma, 10 months ago

Resolution: → fixed
Status: assigned → closed

SA-12.4-042 filed.

comment:9 by Bruce Dubbs, 8 months ago

Milestone: 12.5 → 13.0

Milestone renamed

Note: See TracTickets for help on using tickets.