Summary
It was discovered that CUPS incorrectly handled authentication types other
than Basic. An attacker could possibly use this issue to bypass
authentication. (CVE-2025-58060)
It was discovered that CUPS incorrectly handled deserialization and
validation of printer attributes. An attacker could possibly use this
issue to cause a denial of service. (CVE-2025-58364)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | cups | 2.4.1op1-1ubuntu4.12 |
| Ubuntu · 24.04 LTS 24.04:LTS | cups | 2.4.7-1.2ubuntu7.4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | cups | 2.1.3-4ubuntu0.11+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | cups | 2.2.7-1ubuntu2.10+esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | cups | 2.3.1-9ubuntu1.9+esm1 |
Vulnerabilities 2
-
High 8.0CVE-2025-58060 Public exploit
cups has Authentication bypass with AuthType Negotiate
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password…
-
Medium 6.5
cups: Remote DoS via null dereference
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remot…