Re: [Buildroot] [PATCH] package/cups: security bump to v2.4.16

Peter Korsgaard
2026-02-26T15:46:55Z

>>>>> "Thomas" == Thomas Perale via buildroot <buildroot@buildroot.org> writes:

> For more information on the version bump, see:
> - https://github.com/OpenPrinting/cups/blob/v2.4.16/CHANGES.md
> - https://github.com/OpenPrinting/cups/releases/tag/v2.4.16
> - https://github.com/OpenPrinting/cups/releases/tag/v2.4.15

> Fixes the following vulnerabilities:

> - CVE-2025-58436:
> OpenPrinting CUPS is an open source printing system for Linux and
> other Unix-like operating systems. Prior to version 2.4.15, a client
> that connects to cupsd but sends slow messages, e.g. only one byte per
> second, delays cupsd as a whole, such that it becomes unusable by
> other clients.

> For more information, see
> - https://www.cve.org/CVERecord?id=CVE-2025-58436
> - https://github.com/OpenPrinting/cups/commit/40008d76a001babbb9beb9d9d74b01a86fb6ddb4

> - CVE-2025-61915:
> OpenPrinting CUPS is an open source printing system for Linux and
> other Unix-like operating systems. Prior to version 2.4.15, a user in
> the lpadmin group can use the cups web ui to change the config and
> insert a malicious line. Then the cupsd process which runs as root
> will parse the new config and cause an out-of-bound write.

> For more information, see
> - https://www.cve.org/CVERecord?id=CVE-2025-61915
> - https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0

> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Committed, thanks.

--
Bye, Peter Korsgaard