CUPS Regression Fix: Patching Security Updates Without Breaking Printers
Ubuntu released USN-8405-2 to address a regression in CUPS security patches that caused crashes when parsing large PPD files. The update resolves stability issues while maintaining fixes for multiple critical vulnerabilities.
TL;DR
- USN-8405-1 security patches for CUPS introduced a regression causing crashes on large printer configuration files
- Four CVEs addressed in original update: authorization bypass, file overwrite, code execution, and PostScript queue vulnerabilities
- USN-8405-2 regression fix restores stability without rolling back critical security improvements
- Organizations should apply the latest patch to avoid service disruptions in printing infrastructure
Ubuntu's CUPS printing service received critical security patches in USN-8405-1 addressing multiple vulnerabilities ranging from local privilege escalation to remote code execution. However, the security update introduced an unintended regression that caused CUPS to crash when processing certain large printer PPD (PostScript Printer Description) files, impacting organizations reliant on stable printing infrastructure.
USN-8405-2 resolves this stability issue while preserving the security fixes from the original advisory. The regression demonstrates the importance of thorough regression testing in security patch cycles, particularly for system services that handle complex file formats and maintain elevated privileges.
Original Vulnerabilities Addressed
- CVE-2026-27447: Improper username comparison in authorization checks allowing local privilege escalation
- CVE-2026-34978: Unsafe handling of notify-recipient-uri values in RSS notifier enabling file overwrite and denial of service
- CVE-2026-34979: Filter option string processing flaw leading to crashes or arbitrary code execution
- CVE-2026-34980: Page-border value handling in shared PostScript queues permitting remote code execution
Regression Impact and Resolution
- Regression caused CUPS daemon crashes when parsing large PPD files, disrupting print services
- USN-8405-2 fixes the parsing issue without reverting security mitigations
- Organizations should prioritize applying the regression fix to maintain both security and availability
- Demonstrates need for comprehensive testing of security patches affecting system-critical services
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.