CUPS: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Summary

Product

Vulnerabilities 2

• Medium 4.3
  CVE-2026-87875

  Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

  The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Sep 9, 2026
• Low 3.0
  CVE-2026-87876

  Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

  Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Sep 9, 2026

Revision history

1. 2026-11-03 #8

   Neue Updates von openSUSE aufgenommen

2. 2026-09-29 #7

   Neue Updates von SUSE aufgenommen

3. 2026-09-27 #6

   Neue Updates von SUSE aufgenommen

4. 2026-09-22 #5

   Neue Updates von SUSE aufgenommen

5. 2026-09-17 #4

   Neue Updates von openSUSE aufgenommen

6. 2026-09-16 #3

   Neue Updates von SUSE aufgenommen

7. 2026-09-13 #2

   Neue Updates von Red Hat aufgenommen

8. 2026-09-09 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-559w-7676-3xrq vom 2026-09-09
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq
• GitHub Security Advisory GHSA-r8jp-q6fh-g5r2 vom 2026-09-09
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2
• Red Hat Security Advisory RHSA-2026:66600 vom 2026-09-12
  https://access.redhat.com/errata/RHSA-2026:66600
• SUSE Security Update SUSE-SU-2026:4216-1 vom 2026-09-17
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029207.html
• openSUSE Security Update OPENSUSE-SU-2026:11785-1 vom 2026-09-17
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KX5YFUOJ5JKV64QGD4WMERKGBI43OV3M/
• SUSE Security Update SUSE-SU-2026:4281-1 vom 2026-09-22
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029348.html
• SUSE Security Update SUSE-SU-2026:23877-1 vom 2026-09-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029408.html
• SUSE Security Update SUSE-SU-2026:23925-1 vom 2026-09-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029480.html
• openSUSE Security Update OPENSUSE-SU-2026:12192-1 vom 2026-11-03
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WMLALBBYDS7VPLUK4OPKLTAI3FYAOFWQ/