FEDORA-2026-bce5853e95 — security update for cups

stable

cups-2.4.17-1.fc44

FEDORA-2026-bce5853e95 created by zdohnal 3 months ago for Fedora 44

2.4.17 - security fixes for CVE-2026-39316, CVE-2026-39314, CVE-2026-34979, CVE-2026-34990, CVE-2026-27447, CVE-2026-34978

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-bce5853e95

This update has been submitted for testing by zdohnal.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago

This update's test gating status has been changed to 'passed'.

3 months ago

This update has been pushed to testing.

3 months ago

filiperosset commented & provided feedback 3 months ago

karma

no regressions noted

zdohnal edited this update.

3 months ago

ankursinha commented & provided feedback 3 months ago

karma

No issues noted

ankursinha commented & provided feedback 3 months ago

karma

No issues noted

This update can be pushed to stable now if the maintainer wishes

3 months ago

derekenz commented & provided feedback 3 months ago

karma

Works

This update has been submitted for stable by bodhi.

There is an ongoing freeze; this will be pushed to stable after the freeze is over.

3 months ago

anotheruser provided feedback 3 months ago

karma

geraldosimiao provided feedback 3 months ago

karma

This update has been pushed to stable.

3 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

3 months ago

in testing

3 months ago

in stable

3 months ago

modified

3 months ago

approved

3 months ago

Builds

cups-2.4.17-1.fc44

BZ#2454946 CVE-2026-34979 cups: OpenPrinting CUPS: Denial of Service via heap-based buffer overflow in job attribute processing

BZ#2454947 CVE-2026-34990 cups: OpenPrinting CUPS: Privilege escalation via arbitrary file overwrite due to coerced authentication

BZ#2454949 CVE-2026-27447 cups: OpenPrinting CUPS: Authorization bypass via case-insensitive username comparison

BZ#2454954 CVE-2026-34980 cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

BZ#2454957 CVE-2026-34978 cups: OpenPrinting CUPS: Denial of Service via path traversal in RSS notifier

BZ#2454990 CVE-2026-34978 cups: OpenPrinting CUPS: Denial of Service via path traversal in RSS notifier [fedora-all]

BZ#2454991 CVE-2026-34980 cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network [fedora-all]

BZ#2454992 CVE-2026-27447 cups: OpenPrinting CUPS: Authorization bypass via case-insensitive username comparison [fedora-all]

BZ#2454993 CVE-2026-34990 cups: OpenPrinting CUPS: Privilege escalation via arbitrary file overwrite due to coerced authentication [fedora-all]

BZ#2454994 CVE-2026-34979 cups: OpenPrinting CUPS: Denial of Service via heap-based buffer overflow in job attribute processing [fedora-all]

BZ#2456107 CVE-2026-39314 cups: CUPS: Denial of Service via integer underflow in IPP attribute handling

BZ#2456120 CVE-2026-39316 cups: CUPS: Denial of Service and potential arbitrary code execution via use-after-free vulnerability when deleting temporary printers.

BZ#2456362 CVE-2026-39314 cups: CUPS: Denial of Service via integer underflow in IPP attribute handling [fedora-all]

BZ#2456363 CVE-2026-39316 cups: CUPS: Denial of Service and potential arbitrary code execution via use-after-free vulnerability when deleting temporary printers. [fedora-all]

BZ#2459218 cups-2.4.17 is available

cups-2.4.17-1.fc44

Automated Test Results

passed