SUSE-SU-2026:2732-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2026:2732-1

MEDIUM6.5

Security update for cups

Published Jul 2, 2026

Modified 3 weeks ago

Fix available

Details

Description of the patch:

This update for cups fixes the following issues

CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
CVE-2026-39316: dangling subscription pointer can lead to a denial of service (1261742).

Affected Packages(11 packages)

cups

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

2.2.7-150000.3.93.1

cups-client

Fixed in:

2.2.7-150000.3.93.1

cups-config

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Micro 5.2SUSE Linux Enterprise Micro 5.3SUSE Linux Enterprise Micro 5.4

Fixed in:

2.2.7-150000.3.93.1

cups-devel

Fixed in:

2.2.7-150000.3.93.1

libcups2

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Micro 5.2SUSE Linux Enterprise Micro 5.3SUSE Linux Enterprise Micro 5.4

Fixed in:

2.2.7-150000.3.93.1

libcupscgi1

Fixed in:

2.2.7-150000.3.93.1

libcupsimage2

Fixed in:

2.2.7-150000.3.93.1

libcupsmime1

Fixed in:

2.2.7-150000.3.93.1

libcupsppdc1