Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cups for openSUSE:Factory checked in at 2026-09-15 12:47:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cups (Old) and /work/SRC/openSUSE:Factory/.cups.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cups" Tue Sep 15 12:47:53 2026 rev:185 rq:1377871 version:2.4.19 Changes: -------- --- /work/SRC/openSUSE:Factory/cups/cups.changes 2026-05-20 15:23:56.704716465 +0200 +++ /work/SRC/openSUSE:Factory/.cups.new.383539/cups.changes 2026-09-15 12:47:57.124762018 +0200 @@ -1,0 +2,15 @@ +Mon Sep 14 10:06:18 UTC 2026 - Johannes Meixner <[email protected]> + +- cups-2.4.19-CVE-2026-87875.patch is based on + https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 + adapted to CUPS 2.4.19 to fix CVE-2026-87875 + "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing + source-length bound - reachable from SNMP supply-description + parsing (backend/snmp-supplies.c)" + https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq + bsc#1279945 + "heap out-of-bounds read in `cupsUTF32ToUTF8()` + due to missing source-length bound + can be reached via the SNMP supply-description parsing" + +------------------------------------------------------------------- New: ---- cups-2.4.19-CVE-2026-87875.patch ----------(New B)---------- New: - cups-2.4.19-CVE-2026-87875.patch is based on https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cups.spec ++++++ --- /var/tmp/diff_new_pack.IH4Son/_old 2026-09-15 12:47:58.146804590 +0200 +++ /var/tmp/diff_new_pack.IH4Son/_new 2026-09-15 12:47:58.147804632 +0200 @@ -107,6 +107,16 @@ # Patch112 cups-2.4.2-additional_policies.patch adds the 'allowallforanybody' policy to cupsd.conf # see SUSE FATE 303515 and https://bugzilla.suse.com/show_bug.cgi?id=936309 Patch112: cups-2.4.2-additional_policies.patch +# Patch113 cups-2.4.19-CVE-2026-87875.patch is based on +# https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 +# adapted to CUPS 2.4.19 to fix CVE-2026-87875 +# "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound +# - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" +# https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq +# "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound +# can be reached via the SNMP supply-description parsing" +# https://bugzilla.suse.com/show_bug.cgi?id=1279945 +Patch113: cups-2.4.19-CVE-2026-87875.patch # Build Requirements: BuildRequires: dbus-1-devel BuildRequires: fdupes @@ -333,7 +343,17 @@ %patch -P 108 -b downgrade-autoconf-requirement.orig # Patch112 cups-2.4.2-additional_policies.patch adds the 'allowallforanybody' policy to cupsd.conf # see SUSE FATE 303515 and https://bugzilla.suse.com/show_bug.cgi?id=936309 -%patch -P 112 -b cups-2.4.2-additional_policies.orig +%patch -P 112 -b additional_policies.orig +# Patch113 cups-2.4.19-CVE-2026-87875.patch is based on +# https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 +# adapted to CUPS 2.4.19 to fix CVE-2026-87875 +# "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound +# - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" +# https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq +# "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound +# can be reached via the SNMP supply-description parsing" +# https://bugzilla.suse.com/show_bug.cgi?id=1279945 +%patch -P113 -b CVE-2026-87875.orig %build # Remove ".SILENT" rule for verbose build output ++++++ cups-2.4.19-CVE-2026-87875.patch ++++++ --- cups/transcode.h.orig 2026-04-27 19:13:21.000000000 +0200 +++ cups/transcode.h 2026-09-14 12:32:10.259316427 +0200 @@ -17,6 +17,9 @@ # include "language.h" +/* Avoid "cups/transcode.h:19:1: note: uint32_t is defined in header <stdint.h>; this is probably fixable by adding #include <stdint.h>" */ +#include <stdint.h> + # ifdef __cplusplus extern "C" { # endif /* __cplusplus */ @@ -34,12 +37,12 @@ extern "C" { */ typedef unsigned char cups_utf8_t; /* UTF-8 Unicode/ISO-10646 unit */ -typedef unsigned long cups_utf32_t; /* UTF-32 Unicode/ISO-10646 unit */ -typedef unsigned short cups_ucs2_t; /* UCS-2 Unicode/ISO-10646 unit */ -typedef unsigned long cups_ucs4_t; /* UCS-4 Unicode/ISO-10646 unit */ +typedef uint32_t cups_utf32_t; /* UTF-32 Unicode/ISO-10646 unit */ +typedef uint16_t cups_ucs2_t; /* UCS-2 Unicode/ISO-10646 unit */ +typedef uint32_t cups_ucs4_t; /* UCS-4 Unicode/ISO-10646 unit */ typedef unsigned char cups_sbcs_t; /* SBCS Legacy 8-bit unit */ -typedef unsigned short cups_dbcs_t; /* DBCS Legacy 16-bit unit */ -typedef unsigned long cups_vbcs_t; /* VBCS Legacy 32-bit unit */ +typedef uint16_t cups_dbcs_t; /* DBCS Legacy 16-bit unit */ +typedef uint32_t cups_vbcs_t; /* VBCS Legacy 32-bit unit */ /* EUC uses 8, 16, 24, 32-bit */
