Home / mailings [slackware-security] cups (SSA:2026-278-01)
Posted on 06 October 2026
Slackware Security[slackware-security] cups (SSA:2026-278-01)
New cups packages are available for Slackware 15.0 and -current to
fix security issues.
Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/cups-2.4.20-i586-1_slack15.0.txz: Upgraded.
This update fixes security issues:
The scheduler did not open temporary PPD files in exclusive mode.
The scheduler did not remove all job status attributes from a job creation
request.
The scheduler did not validate the request language value.
Attribute names were not validated as proper keyword values.
The `cupsUTF32toUTF8` function incorrectly treated UTF-32 values as 64-bit.
Held jobs for temporary print queues could crash the scheduler.
The backend did not sanitize IPP attribute strings.
The scheduler did not filter out group separators from job submissions.
Quota and policy operations did not treat usernames as case-sensitive.
The scheduler's startup permission checks were vulnerable to TOU attacks.
The scheduler did not sanitize fax numbers.
The 'mailto' notifier did not sanitize the recipient address provided to the
sendmail command.
The scheduler could crash when modifying a class.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-55480
https://github.com/openprinting/cups/security/advisories/GHSA-r9hj-j2rw-4q3m
https://github.com/openprinting/cups/security/advisories/GHSA-7j85-5r23-xhvh
https://www.cve.org/CVERecord?id=CVE-2026-61702
https://github.com/openprinting/cups/security/advisories/GHSA-w9hj-hq9p-m7f6
https://www.cve.org/CVERecord?id=CVE-2026-87875
https://github.com/openprinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55
https://www.cve.org/CVERecord?id=CVE-2026-55453
https://github.com/openprinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x
https://www.cve.org/CVERecord?id=CVE-2026-87876
https://github.com/openprinting/cups/security/advisories/GHSA-gj33-wxpv-6fgg
https://www.cve.org/CVERecord?id=CVE-2026-55467
https://www.cve.org/CVERecord?id=CVE-2026-105326
https://github.com/openprinting/cups/security/advisories/GHSA-pwg4-pv39-8c22
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/cups-2.4.20-i586-1_slack15.0.txz
Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/cups-2.4.20-x86_64-1_slack15.0.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/cups-2.4.19-i686-2.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/cups-2.4.20-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 15.0 package:
ec0565e851bb8598d7da77776d4ced3c cups-2.4.20-i586-1_slack15.0.txz
Slackware x86_64 15.0 package:
e7ea3beb82b30e86732d3d74f9475ee5 cups-2.4.20-x86_64-1_slack15.0.txz
Slackware -current package:
dd6664efacd6ea30a4a23a2f39cb102f ap/cups-2.4.19-i686-2.txz
Slackware x86_64 -current package:
9136bc3148f67a2f40a3b723a41e7e6a ap/cups-2.4.20-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg cups-2.4.20-i586-1_slack15.0.txz
Then, restart the cups server:
# sh /etc/rc.d/rc.cups restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
