{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: filter control characters from option values in the\n scheduler to prevent PPD keyword injection via Print-Job.\n - debian/patches/CVE-2026-34980.patch: filter out control characters\n from IPP option values in scheduler/job.c and allowlist-filter\n special PPD keywords in the CUPSD_LOG_PPD branch of update_job();\n includes the upstream follow-ups for Issue #1532 (get_options() no\n longer loops forever on a value holding whitespace or a dropped\n control character), Issue #1562 (the allowlist advances its keyword\n pointer instead of testing keywords[0] repeatedly), Issue #1630\n (whitespace stays backslash-escaped, so cupsParseOptions() in the\n filters no longer truncates option values containing spaces) and\n the case-insensitive keyword comparison that closes a\n \"cupsfilter2\" spelling bypass of the allowlist.\n - CVE-2026-34980.\n * Make the package testable on the ELS build nodes. None of these\n three changes is a CVE fix; the two patches are also carried by\n tuxcare-current/debian10els.\n - debian/patches/maxfds-limit.patch: cap MaxFDs at 65535 in\n scheduler/main.c, backported from upstream Issue #989\n (beb84401c6698dfe937178d8ac8fa38505468dbb), so cupsd stops\n aborting at startup with \"cupsdDoSelect() failed - Bad address!\"\n on hosts whose RLIMIT_NOFILE hard limit is very large but not\n RLIM_INFINITY.\n - debian/patches/waiting-limit.patch: bound the \"waiting for the\n scheduler\" loop in test/run-stp-tests.sh at 60 seconds and take\n the test user from \"id -un\", so a scheduler that will not start\n fails the build with a diagnostic instead of hanging until the\n build system's 12 hour task limit.\n - debian/rules: hand test/run-stp-tests.sh a free TCP port instead of\n letting its cupsd default to 8631. CUPS_TESTBASE already keeps the\n config, spool, logs and domain socket of a run private, but pbuilder\n chroots share the host network namespace, so two cups builds on one\n node used to fight over that one port -- the second scheduler could\n not bind, the first answered its \"lpstat -r\" anyway, and both suites\n then drove a single cupsd, inflating every absolute count in the\n test summary.", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788967622", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788967622" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1788967622.json" } ], "tracking": { "current_release_date": "2026-09-09T15:28:23Z", "generator": { "date": "2026-09-09T15:28:23Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1788967622", "initial_release_date": "2026-09-09T15:28:23Z", "revision_history": [ { "date": "2026-09-09T15:28:23Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2026-34980" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-core-drivers@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-ppdc@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcupsimage2-dev@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-ipp-utils@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-client@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcups2-dev@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-bsd@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcupsimage2@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-daemon@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } }, { "category": "product_version", "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product": { "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_id": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcups2@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=armel" } } } ], "category": "architecture", "name": "armel" }, { "branches": [ { "category": "product_version", "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-core-drivers@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-ppdc@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcupsimage2-dev@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-ipp-utils@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-client@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcups2-dev@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-bsd@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcupsimage2@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-daemon@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } }, { "category": "product_version", "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product": { "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_id": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcups2@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=arm64" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-core-drivers@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-ppdc@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcupsimage2-dev@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-ipp-utils@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-client@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcups2-dev@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-bsd@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcupsimage2@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-daemon@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product": { "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_id": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcups2@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "product": { "name": "cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "product_id": "cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-common@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "product": { "name": "cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "product_id": "cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/cups-server-common@2.3.3op2-3%2Bdeb11u10%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all" }, "product_reference": "cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel as a component of Debian 11", "product_id": "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" }, "product_reference": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64 as a component of Debian 11", "product_id": "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64" }, "product_reference": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64 as a component of Debian 11", "product_id": "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64" }, "product_reference": "libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all" }, "product_reference": "cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-34980", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-34980" }, { "category": "external", "summary": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf", "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf" } ], "release_date": "2026-04-03T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-09T15:27:04.555348Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788967622", "product_ids": [ "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-bsd-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-client-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-core-drivers-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-daemon-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-ipp-utils-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:cups-ppdc-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:cups-server-common-0:2.3.3op2-3+deb11u10+tuxcare.els1.all", "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcups2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcups2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcupsimage2-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel", "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.amd64", "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.arm64", "Debian-11:libcupsimage2-dev-0:2.3.3op2-3+deb11u10+tuxcare.els1.armel" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788967622" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }