]> git.ipfire.org Git - thirdparty/cups.git/commit
Fix various issues in cupsd
authorZdenek Dohnal <zdohnal@redhat.com>
Fri, 21 Nov 2025 06:36:36 +0000 (07:36 +0100)
committerZdenek Dohnal <zdohnal@redhat.com>
Thu, 27 Nov 2025 15:06:02 +0000 (16:06 +0100)
commitdb8d560262c22a21ee1e55dfd62fa98d9359bcb0
tree6b0069de0a5628c5cd4fe14ced46a0142c746e61
parent40026058d3d127eeb91c6229e351a8d1d4ecdea6
Fix various issues in cupsd

Various issues were found by @SilverPlate3, recognized as CVE-2025-61915:

- out of bound write when handling IPv6 addresses,
- cupsd crash caused by null dereference when ErrorPolicy value is empty,

On the top of that, Mike Sweet noticed vulnerability via domain socket,
exploitable locally if attacker has access to domain socket and knows username
of user within a group which is present in CUPS system groups:

- rewrite of cupsd.conf via PeerCred authorization via domain socket

The last vulnerability is fixed by introducing PeerCred directive for cups-files.conf,
which controls whether PeerCred is enabled/disabled for user in CUPS system groups.

Fixes CVE-2025-61915
14 files changed:
conf/cups-files.conf.in
config-scripts/cups-defaults.m4
config.h.in
configure
doc/help/man-cups-files.conf.html
man/cups-files.conf.5
scheduler/auth.c
scheduler/auth.h
scheduler/client.c
scheduler/conf.c
test/run-stp-tests.sh
vcnet/config.h
xcode/CUPS.xcodeproj/project.pbxproj
xcode/config.h