openSUSE-SU-2026:22120-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22120-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22120-1

Upstream

CVE-2026-95511

Related

CVE-2026-95511

Published

2026-10-15T22:10:08Z

Modified

2026-10-19T17:23:15Z

Summary

Security update for cups-filters

Details

This update for cups-filters fixes the following issues:

Changes in cups-filters:

No longer provide the serial backend with 0700 permissions so cupsd does no longer run it as root but as usual as user 'lp' to avoid CVE-2026-95511 "Root arbitrary file overwrite via serial ... device-URI path" https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-m74w-wg6q-vvpj "lpadmin user can escalate privileges to root via printers that uses a privileged serial backend" (bsc#1282291) Note the general security advice in the section "Allow printer admin tasks for a normal user" in https://en.opensuse.org/SDB:CUPS_in_a_Nutshell
No longer provide any other backend with 0700 permissions so cupsd does no longer run them as root but as usual as user 'lp' because running something as root by default is a generic security issue which we avoid now by default so the user must set less secure permissions manually only as specifically needed. In particular no longer provide /usr/lib/cups/backend/beh /usr/lib/cups/backend/cups-brf /usr/lib/cups/backend/implicitclass with 0700 permissions by default so in particular https://bugzilla.opensuse.org/show_bug.cgi?id=1178604 re-appears but security by default is mandatory nowadays, cf. the sections "Security: Make Things Not Just Work" and "Automated print queue setup via cups-browsed" in https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

References

Affected packages

openSUSE:Leap 16.0 / cups-filters

Package

Name: cups-filters
Purl: pkg:rpm/opensuse/cups-filters&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.28.17-bp160.3.1

Ecosystem specific

{
    "binaries":  [
        {
            "cups-filters":  "1.28.17-bp160.3.1",
            "cups-filters-cups-browsed":  "1.28.17-bp160.3.1",
            "cups-filters-devel":  "1.28.17-bp160.3.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22120-1.json"