Skip to content
OpenAdvisories
High RLSA-2025:15701 2 CVEs

Important: cups security update

Published Oct 3, 2025 · Updated Oct 8, 2025

Ecosystem: Rocky Linux

Summary

The Common UNIX Printing System (CUPS) provides a portable printing layer for
Linux, UNIX, and similar operating systems.

Security Fix(es):

* cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)
* cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 cups 1:2.4.10-11.el10_0.1

Vulnerabilities 2

  • High 8.0
    CVE-2025-58060 Public exploit

    cups has Authentication bypass with AuthType Negotiate

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-58364

    cups: Remote DoS via null dereference

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remot…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2392595
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393078