Ubuntu alert USN-8578-1 (CUPS)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8578-1] CUPS control character injection vulnerability
Date:
             
 
Tue, 21 Jul 2026 17:52:12 +0000
Message-ID:
             
 
<E1wmEdY-00054R-MF@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8578-1
July 21, 2026

CUPS vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

CUPS could be made to run programs as the lp user if it received specially crafted print job
requests.

Software Description:
- cups: Common UNIX Printing System(tm)

Details:

It was discovered that CUPS did not properly filter control characters in IPP string attributes and
PPD keywords. An unauthenticated attacker could exploit this to execute arbitrary code as the lp
user on systems with shared target queues.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS
  cups                            2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro
  cups-bsd                        2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro
  cups-client                     2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro
  cups-common                     2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro
  cups-core-drivers               2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro
  cups-daemon                     2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro
  libcups2                        2.1.3-4ubuntu0.11+esm13
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8578-1
  CVE-2026-34980


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpflbAACgkQcpJm3tlz
hgFi2RAAs4HolOqdKDHRhQqvQhwV8fx2Ws9L+vuvTtiCBKWp5bkO1wAxcbhjLSVT
T2jjvJVwOcFANDwCUzUlzNeB2E2hkAbj4je9pbMHvCw0koa6bJvZb8hqYTO5OsLq
0ef95b7ah1w6W+k1bZKjx958SV205nSdCXqpnJYrDOc0MJPTNJ1e153ihE9gTxZo
gXn50kNtQm1rRVPbBILUL9rPtzmu/2h80ljQr4YYEEwgxsH2U1uMh/c+cmiI/KE1
bmng9dNWiPmsybkP8hylVKrNuisraWcK1bXAJYVjykNAeIHcKvlV36hS4TQFu33k
MVGbB5I9Upp6GOHRR0a/TvlTPd0dcSd0gPGa7wQMHcedQtDIWg9/EHZ0q/HEW9Vl
N8lof3xW0FSvu69ixTZweF1J/vnW55XCq4q1SANXrCGWQQ84cj2BOVgff9XT6+ba
MhvqTTADEWo+XqqeD2p4ltEXN+7BKo5gulPhhNGKoWWpdQWrEkq/40OT0IxhLx5B
UxVCbvcaHOjoQrR2xLrkIcgs2cNvYcI0Fl2UL4ON29PrSrjkY5eNlflAOZuR0lD5
VMnjiseoO9Ed35lba6TmFub5hUaVeSlWft1jz8E5C5g7NW8Rs+5Vx7c/AQtAdGJK
BXvsR5xvESkR1aeGpxYQB7dZMO+26FZ0xJDSGPnUxeGGmKPM56M=
=2SU9
-----END PGP SIGNATURE-----