Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libcupsfilters for openSUSE:Factory checked in at 2026-09-04 12:40:09 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libcupsfilters (Old) and /work/SRC/openSUSE:Factory/.libcupsfilters.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libcupsfilters" Fri Sep 4 12:40:09 2026 rev:2 rq:1375548 version:2.1.1 Changes: -------- --- /work/SRC/openSUSE:Factory/libcupsfilters/libcupsfilters.changes 2025-06-02 22:00:02.527931083 +0200 +++ /work/SRC/openSUSE:Factory/.libcupsfilters.new.1265/libcupsfilters.changes 2026-09-04 12:41:16.801417544 +0200 @@ -1,0 +2,23 @@ +Thu Sep 3 07:31:26 UTC 2026 - Johannes Meixner <[email protected]> + +- libcupsfilters-2.1.1-CVE-2026-64611.patch is based on + https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 + backported to libcupsfilters 2.1.1 to fix CVE-2026-64611 + "Infinite-loop CPU-exhaustion DoS in + cfIEEE1284NormalizeMakeModel on empty MDL field" + https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4 + "user who controls an IEEE-1284 device ID consumed by + `cfIEEE1284GetMakeModel` can drive + `cfIEEE1284NormalizeMakeModel` into an infinite loop" + (bsc#1273145) +- libcupsfilters-2.1.1-CVE-2026-64612.patch is based on + https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 + backported to libcupsfilters 2.1.1 to fix CVE-2026-64612 + "Malformed PNG aborts CUPS image filter process + (missing libpng setjmp recovery)" + https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch + "authenticated client that can submit an image print job + can abort the CUPS filter process by supplying a malformed PNG" + (bsc#1273146) + +------------------------------------------------------------------- New: ---- libcupsfilters-2.1.1-CVE-2026-64611.patch libcupsfilters-2.1.1-CVE-2026-64612.patch ----------(New B)---------- New: - libcupsfilters-2.1.1-CVE-2026-64611.patch is based on https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 New: (bsc#1273145) - libcupsfilters-2.1.1-CVE-2026-64612.patch is based on https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libcupsfilters.spec ++++++ --- /var/tmp/diff_new_pack.nPjCms/_old 2026-09-04 12:41:18.141464601 +0200 +++ /var/tmp/diff_new_pack.nPjCms/_new 2026-09-04 12:41:18.142464637 +0200 @@ -26,6 +26,23 @@ # To get Source0 go to https://github.com/OpenPrinting/libcupsfilters/releases and use e.g. # wget https://github.com/OpenPrinting/libcupsfilters/releases/download/2.1.1/libcupsfilters-2.1.1.tar.gz Source0: libcupsfilters-%{version}.tar.gz +# Patch100 libcupsfilters-2.1.1-CVE-2026-64612.patch is based on +# https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 +# backported to libcupsfilters 2.1.1 to fix CVE-2026-64612 +# "Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery)" +# https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch +# "authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG" +# https://bugzilla.suse.com/show_bug.cgi?id=1273146 +Patch100: libcupsfilters-2.1.1-CVE-2026-64612.patch +# Patch111 libcupsfilters-2.1.1-CVE-2026-64611.patch is based on +# https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 +# backported to libcupsfilters 2.1.1 to fix CVE-2026-64611 +# "Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field" +# https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4 +# "user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop" +# https://bugzilla.suse.com/show_bug.cgi?id=1273145 +Patch111: libcupsfilters-2.1.1-CVE-2026-64611.patch +# Build Requirements: BuildRequires: cups-devel >= 2.2.2 BuildRequires: ghostscript-devel >= 10.0.0 BuildRequires: qpdf-devel >= 10.3.2 ++++++ libcupsfilters-2.1.1-CVE-2026-64611.patch ++++++ --- libcupsfilters-2.1.1.original/cupsfilters/ieee1284.c 2025-02-18 23:48:01.000000000 +0100 +++ libcupsfilters-2.1.1.patched/cupsfilters/ieee1284.c 2026-09-03 09:27:20.693415244 +0200 @@ -407,6 +407,12 @@ cfIEEE1284GetMakeModel( num_values = cfIEEE1284GetValues(device_id, &values); + if (!num_values) + { + DEBUG_puts("cfIEEE1284GetMakeModel: no key:value pairs"); + return (-1); + } + if ((mdl = cupsGetOption("MODEL", num_values, values)) == NULL) mdl = cupsGetOption("MDL", num_values, values); @@ -573,6 +579,9 @@ cfIEEE1284GetValues( *ptr = '\0'; device_id ++; + if (!key[0] || !value[0]) + continue; + num_values = cupsAddOption(key, value, num_values, values); } @@ -668,6 +677,7 @@ cfIEEE1284NormalizeMakeModel( char *bufptr; // Pointer into buffer char sepchr = ' '; // Word separator character int compare = 0, // Format for comparing + compare_len = 0, // Length of compared buffer human = 0, // Format for human-readable string lower = 0, // All letters lowercase upper = 0, // All letters uppercase @@ -1119,7 +1129,8 @@ cfIEEE1284NormalizeMakeModel( // Remove repeated manufacturer names... // - while (strncasecmp(buffer, modelptr, modelptr - buffer) == 0) + compare_len = modelptr - buffer; + while (compare_len > 0 && strncasecmp(buffer, modelptr, compare_len) == 0) move_right_part(buffer, bufsize, modelptr, buffer - modelptr); // ++++++ libcupsfilters-2.1.1-CVE-2026-64612.patch ++++++ --- libcupsfilters-2.1.1.original/cupsfilters/image-png.c 2025-02-18 23:48:01.000000000 +0100 +++ libcupsfilters-2.1.1.patched/cupsfilters/image-png.c 2026-09-02 14:52:57.713804846 +0200 @@ -20,6 +20,34 @@ #ifdef HAVE_LIBPNG # include <png.h> // Portable Network Graphics (PNG) definitions +# include <setjmp.h> + + +// +// Custom error handler for libpng โ longjmp() back to the setjmp() +// point in the caller instead of the default abort(), so a malformed +// PNG results in a graceful error return. +// + +static void +cf_image_png_error_callback(png_structp png, + png_const_charp error_msg) +{ + DEBUG_printf(("DEBUG: libpng error: %s\n", error_msg)); + longjmp(png_jmpbuf(png), 1); +} + +// +// Custom warning handler for libpng โ log non-fatal issues +// and return normally so processing continues. +// + +static void +cf_image_png_warning_callback(png_structp png, + png_const_charp warning_msg) +{ + DEBUG_printf(("DEBUG: libpng warning: %s\n", warning_msg)); +} // @@ -51,18 +79,52 @@ _cfImageReadPNG( int bpp; // Bytes per pixel int pass, // Current pass passes; // Number of passes required - cf_ib_t *in, // Input pixels - *inptr, // Pointer into pixels - *out; // Output pixels + cf_ib_t * volatile in = NULL; // Input pixels (volatile for setjmp) + cf_ib_t *inptr; // Pointer into pixels + cf_ib_t * volatile out = NULL; // Output pixels (volatile for setjmp) png_color_16 bg; // Background color // - // Setup the PNG data structures... + // Setup the PNG data structures with custom error/warning handlers + // so that a malformed PNG causes an error return instead of abort(). + // Errors during struct creation are handled internally by libpng + // and result in a NULL return. Errors in any png_*() call after + // setjmp() trigger our error callback which longjmp()s back. // - pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); + pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, + cf_image_png_error_callback, + cf_image_png_warning_callback); + if (pp == NULL) + { + fclose(fp); + return (1); + } + info = png_create_info_struct(pp); + if (info == NULL) + { + png_destroy_read_struct(&pp, NULL, NULL); + fclose(fp); + return (1); + } + + // + // Error handling jump point โ if any png_*() call below triggers + // png_error(), our callback longjmp()s back here. The 'in' and + // 'out' pointers are initialized to NULL so free() is safe here + // even if longjmp() reverts them (C11 ยง7.13.2.1). + // + + if (setjmp(png_jmpbuf(pp))) + { + free(in); + free(out); + png_destroy_read_struct(&pp, &info, NULL); + fclose(fp); + return (1); + } // // Initialize the PNG read "engine"...
