shield Security update for cups

SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-2732

This update for cups fixes the following issues - CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572). - CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571). - CVE-2026-34979: Heap overflow in `get_options()` (bsc#1261570). - CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (bsc#1261569). - CVE-2026-39314: negative `job-password-supported` attribute can lead to a denial of service (bsc#1261743). - CVE-2026-39316: dangling subscription pointer can lead to a denial of service (1261742).

• Release Date
  Jul 2 2026
• References
  Bugzilla: 1261569, 1261570, 1261571, 1261572, 1261742, 1261743
  CVEs: CVE-2026-27447, CVE-2026-34978, CVE-2026-34979, CVE-2026-34980, CVE-2026-39314, CVE-2026-39316
• Type
  security
• Severity
  moderate

cloud_download Downloads

Desktop Applications Module 15.7 x86_64

• Packages
  cups
  The Common UNIX Printing System

  2.2.7-150000.3.93.1 lock src

  libcups2-32bit
  HTTP/IPP communication and printer queue and job library

  2.2.7-150000.3.93.1 lock rpm