{"id":"openSUSE-SU-2026:22120-1","summary":"Security update for cups-filters","details":"This update for cups-filters fixes the following issues:\n\nChanges in cups-filters:\n\n- No longer provide the serial backend with 0700 permissions\n  so cupsd does no longer run it as root but as usual\n  as user 'lp' to avoid CVE-2026-95511\n  \"Root arbitrary file overwrite via serial ... device-URI path\"\n  https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-m74w-wg6q-vvpj\n  \"`lpadmin` user can escalate privileges to `root` via printers\n   that uses a privileged serial backend\" (bsc#1282291)\n  Note the general security advice in the section\n  \"Allow printer admin tasks for a normal user\" in\n  https://en.opensuse.org/SDB:CUPS_in_a_Nutshell\n\n- No longer provide any other backend with 0700 permissions\n  so cupsd does no longer run them as root but as usual\n  as user 'lp' because running something as root by default\n  is a generic security issue which we avoid now by default\n  so the user must set less secure permissions manually\n  only as specifically needed. In particular no longer provide\n  /usr/lib/cups/backend/beh\n  /usr/lib/cups/backend/cups-brf\n  /usr/lib/cups/backend/implicitclass\n  with 0700 permissions by default so in particular\n  https://bugzilla.opensuse.org/show_bug.cgi?id=1178604\n  re-appears but security by default is mandatory nowadays,\n  cf. the sections \"Security: Make Things Not Just Work\"\n  and \"Automated print queue setup via cups-browsed\" in\n  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings\n","modified":"2026-10-19T17:23:15.395106377Z","published":"2026-10-15T22:10:08Z","related":["CVE-2026-95511"],"upstream":["CVE-2026-95511"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282291"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-95511"}],"affected":[{"package":{"name":"cups-filters","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cups-filters&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.17-bp160.3.1"}]}],"ecosystem_specific":{"binaries":[{"cups-filters-devel":"1.28.17-bp160.3.1","cups-filters":"1.28.17-bp160.3.1","cups-filters-cups-browsed":"1.28.17-bp160.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22120-1.json"}}],"schema_version":"1.9.0"}