Skip to content
OpenAdvisories
Unscored USN-6844-2 0 CVEs

cups regression

Published Jun 28, 2024 · Updated Jun 25, 2026

Summary

USN-6844-1 fixed vulnerabilities in the CUPS package. The update
lead to the discovery of a regression in CUPS with regards to
how the cupsd daemon handles Listen configuration directive.
This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:
Rory McNamara discovered that when starting the cupsd server with a
Listen configuration item, the cupsd process fails to validate if
bind call passed. An attacker could possibly trick cupsd to perform
an arbitrary chmod of the provided argument, providing world-writable
access to the target.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS cups 2.3.1-9ubuntu1.8
Ubuntu · 22.04 LTS 22.04:LTS cups 2.4.1op1-1ubuntu4.10
Ubuntu · 24.04 LTS 24.04:LTS cups 2.4.7-1.2ubuntu7.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS cups 2.1.3-4ubuntu0.11+esm7
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS cups 2.2.7-1ubuntu2.10+esm5

References

  • report
    https://launchpad.net/bugs/2070315