Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cups-filters for openSUSE:Factory checked in at 2026-09-04 12:36:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cups-filters (Old) and /work/SRC/openSUSE:Factory/.cups-filters.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cups-filters" Fri Sep 4 12:36:24 2026 rev:64 rq:1375096 version:1.28.17 Changes: -------- --- /work/SRC/openSUSE:Factory/cups-filters/cups-filters.changes 2026-06-09 14:20:46.601774131 +0200 +++ /work/SRC/openSUSE:Factory/.cups-filters.new.1265/cups-filters.changes 2026-09-04 12:37:03.907535460 +0200 @@ -1,0 +2,23 @@ +Tue Sep 1 11:05:03 UTC 2026 - Johannes Meixner <[email protected]> + +- cups-filters-1.28.17-CVE-2026-64611.patch is based on + https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 + backported to cups-filters 1.28.17 to fix CVE-2026-64611 + "Infinite-loop CPU-exhaustion DoS in + cfIEEE1284NormalizeMakeModel on empty MDL field" + https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4 + "user who controls an IEEE-1284 device ID consumed by + `cfIEEE1284GetMakeModel` can drive + `cfIEEE1284NormalizeMakeModel` into an infinite loop" + (bsc#1273145) +- cups-filters-1.28.17-CVE-2026-64612.patch is based on + https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 + backported to cups-filters 1.28.17 to fix CVE-2026-64612 + "Malformed PNG aborts CUPS image filter process + (missing libpng setjmp recovery)" + https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch + "authenticated client that can submit an image print job + can abort the CUPS filter process by supplying a malformed PNG" + (bsc#1273146) + +------------------------------------------------------------------- New: ---- cups-filters-1.28.17-CVE-2026-64611.patch cups-filters-1.28.17-CVE-2026-64612.patch ----------(New B)---------- New: - cups-filters-1.28.17-CVE-2026-64611.patch is based on https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 New: (bsc#1273145) - cups-filters-1.28.17-CVE-2026-64612.patch is based on https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cups-filters.spec ++++++ --- /var/tmp/diff_new_pack.8HUbRK/_old 2026-09-04 12:37:04.948572010 +0200 +++ /var/tmp/diff_new_pack.8HUbRK/_new 2026-09-04 12:37:04.950572080 +0200 @@ -99,7 +99,7 @@ # So this patch removes CUPS Browsing support in cups-browsed, see the upstream commit # https://github.com/OpenPrinting/cups-browsed/commit/1d1072a0de573b7850958df614e9ec5b73ea0e0d Patch108: cups-filters-1.28.17-CVE-2024-47176.patch -# Patch109 cups-filters-1.25.0-CVE-2024-47076.patch is based on +# Patch109 cups-filters-1.28.17-CVE-2024-47076.patch is based on # https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3 # backported to cups-filters 1.28.17 to fix CVE-2024-47076 # "lack of input sanitization in cfGetPrinterAttributes5" @@ -117,6 +117,22 @@ # https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285412 # newer cups code in git does not use qpdf, no upstream handling required Patch111: cups-filters-qpdf12.patch +# Patch112 cups-filters-1.28.17-CVE-2026-64612.patch is based on +# https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 +# backported to cups-filters 1.28.17 to fix CVE-2026-64612 +# "Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery)" +# https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch +# "authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG" +# https://bugzilla.suse.com/show_bug.cgi?id=1273146 +Patch112: cups-filters-1.28.17-CVE-2026-64612.patch +# Patch113 cups-filters-1.28.17-CVE-2026-64611.patch is based on +# https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 +# backported to cups-filters 1.28.17 to fix CVE-2026-64611 +# "Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field" +# https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4 +# "user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop" +# https://bugzilla.suse.com/show_bug.cgi?id=1273145 +Patch113: cups-filters-1.28.17-CVE-2026-64611.patch # Support for cups154 in the SLE12 legacy module is abandoned (by default SLE12 has CUPS 1.7.5) # because newer cups-filters versions use stuff that is provided since CUPS > 1.5.4 so that it does # no longer build with CUPS 1.5.4 so that cups-filters does not work with CUPS 1.5.4: ++++++ cups-filters-1.28.17-CVE-2026-64611.patch ++++++ --- cups-filters-1.28.17.original/backend/ieee1284.c.orig 2023-01-25 02:41:08.000000000 +0100 +++ cups-filters-1.28.17.patched/backend/ieee1284.c 2026-09-01 12:54:29.720935507 +0200 @@ -418,6 +418,12 @@ backendGetMakeModel( num_values = get_1284_values(device_id, &values); + if (!num_values) + { + DEBUG_puts("backendGetMakeModel: no key:value pairs"); + return (-1); + } + if ((mdl = cupsGetOption("MODEL", num_values, values)) == NULL) mdl = cupsGetOption("MDL", num_values, values); @@ -578,6 +584,9 @@ get_1284_values( *ptr = '\0'; device_id ++; + if (!key[0] || !value[0]) + continue; + num_values = cupsAddOption(key, value, num_values, values); } ++++++ cups-filters-1.28.17-CVE-2026-64612.patch ++++++ --- cups-filters-1.28.17.original/cupsfilters/image-png.c.orig 2023-01-25 02:41:08.000000000 +0100 +++ cups-filters-1.28.17.patched/cupsfilters/image-png.c 2026-09-01 12:54:44.761106399 +0200 @@ -23,6 +23,28 @@ #if defined(HAVE_LIBPNG) && defined(HAVE_LIBZ) # include <png.h> /* Portable Network Graphics (PNG) definitions */ +// +// Custom error handler for libpng โ longjmp() back to the setjmp() +// point in the caller instead of the default abort(), so a malformed +// PNG results in a graceful error return. +// +static void +cf_image_png_error_callback(png_structp png, + png_const_charp error_msg) +{ + DEBUG_printf(("DEBUG: libpng error: %s\n", error_msg)); + longjmp(png_jmpbuf(png), 1); +} +// +// Custom warning handler for libpng โ log non-fatal issues +// and return normally so processing continues. +// +static void +cf_image_png_warning_callback(png_structp png, + png_const_charp warning_msg) +{ + DEBUG_printf(("DEBUG: libpng warning: %s\n", warning_msg)); +} /* * '_cupsImageReadPNG()' - Read a PNG image file. @@ -53,18 +75,49 @@ _cupsImageReadPNG( int bpp; /* Bytes per pixel */ int pass, /* Current pass */ passes; /* Number of passes required */ - cups_ib_t *in, /* Input pixels */ - *inptr, /* Pointer into pixels */ - *out; /* Output pixels */ + cups_ib_t * volatile in = NULL; /* Input pixels (volatile for setjmp) */ + cups_ib_t *inptr; /* Pointer into pixels */ + cups_ib_t * volatile out = NULL; /* Output pixels (volatile for setjmp) */ png_color_16 bg; /* Background color */ - - /* - * Setup the PNG data structures... - */ - - pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); + // + // Setup the PNG data structures with custom error/warning handlers + // so that a malformed PNG causes an error return instead of abort(). + // Errors during struct creation are handled internally by libpng + // and result in a NULL return. Errors in any png_*() call after + // setjmp() trigger our error callback which longjmp()s back. + // + pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, + cf_image_png_error_callback, + cf_image_png_warning_callback); + if (pp == NULL) + { + fclose(fp); + return (1); + } + info = png_create_info_struct(pp); + if (info == NULL) + { + png_destroy_read_struct(&pp, NULL, NULL); + fclose(fp); + return (1); + } + + // + // Error handling jump point โ if any png_*() call below triggers + // png_error(), our callback longjmp()s back here. The 'in' and + // 'out' pointers are initialized to NULL so free() is safe here + // even if longjmp() reverts them (C11 ยง7.13.2.1). + // + if (setjmp(png_jmpbuf(pp))) + { + free(in); + free(out); + png_destroy_read_struct(&pp, &info, NULL); + fclose(fp); + return (1); + } /* * Initialize the PNG read "engine"...
