mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 00:20:38 -09:00
9678db2cc5
For more information about the release, see:
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.17
- https://github.com/OpenPrinting/cups/blob/2.4.x/CHANGES.md
The new release 2.4.17 contains the following security fixes:
- CVE-2026-27447: The scheduler treated local user and group names as
case-insensitive.
https://www.cve.org/CVERecord?id=CVE-2026-27447
- CVE-2026-34978: The RSS notifier could write outside the scheduler's
RSS directory.
https://www.cve.org/CVERecord?id=CVE-2026-34978
- CVE-2026-34979: The scheduler did not always allocate enough memory
for a job's options string.
https://www.cve.org/CVERecord?id=CVE-2026-34979
- CVE-2026-34980: The scheduler did not filter control characters from
option values.
https://www.cve.org/CVERecord?id=CVE-2026-34980
- CVE-2026-34990: The scheduler incorrectly allowed local certificates
over the loopback interface.
https://www.cve.org/CVERecord?id=CVE-2026-34990
- CVE-2026-39314: Fixed the range check for job password strings.
https://www.cve.org/CVERecord?id=CVE-2026-39314
- CVE-2026-39316: Fixed a printer subscription bug in the scheduler.
https://www.cve.org/CVERecord?id=CVE-2026-39316
- CVE-2026-41079: Fixed a SNMP string conversion bug in the backends.
https://www.cve.org/CVERecord?id=CVE-2026-41079
Also updated patch offsets.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1f801dc616)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>