There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior
    to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled
    destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options.
    Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are
    copied directly into the filter options argument. A user permitted to submit a job can therefore inject
    control characters into the downstream option stream. The reporter states that a downstream fax filter
    passing these values to a shell or modem command could execute code as lp, while the maintainer states
    that CUPS has no confidentiality or integrity impact because the only known code-executing filter is
    optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue
    is fixed in version 2.4.20. (CVE-2026-55467)

遠端主機上安裝的 cups 版本比 2.4.19/2.4.20 舊。因此會受到 SSA:2026-278-01 公告中提及的多個弱點影響。

    現已提供適用於 Slackware 15.0 和最新版本的新 cups 套件，可修正多個安全性問題。

Tenable 已直接從 cups 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - OpenPrinting CUPS 是適用於 Linux 和其他類 Unix 作業系統的開放原始碼列印系統。在之前 2.4.20，scheduler/job.c 中的 cupsdCreateJob 選項字串產生器會將攻擊者控制的目的地 uri 和預撥號字串值從已設定的傳真佇列對應至電話和 faxPrefix 選項。
    與一般 IPP 工作屬性不同，這些對應的傳真值會繞過控制字元清理程式，並直接複製到篩選選項引數中。因此，容許提交工作的使用者可以將控制字元插入下游選項串流。報告者表示，將這些值傳遞給 shell 或數據機命令的下游傳真過濾器可以以 lp 身分執行程式碼，而維護者則表示 CUPS 對機密性或完整性沒有影響，因為唯一已知的程式碼執行過濾器是可選的 Foomatic 並單獨解決，從而可能中斷受影響的佇列。2.4.20 版已修正此問題。(CVE-2026-55467)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程主机上安装的 cups 版本低于 2.4.19/2.4.20。因此，如公告 SSA:2026-278-01 所述，其会受到多个漏洞影响。

    为 Slackware 15.0 以及当前版本提供了用于修复安全问题的新 cups 程序包。

Tenable 已直接从 cups 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - OpenPrinting CUPS 是适用于 Linux 及其他类 Unix 操作系统的开源打印系统。在版本之前 2.4.20，scheduler/job.c 中的 cupsdCreateJob 选项字符串生成器将攻击者控制的 destination-uri 和 pre-dial-string 值从配置的传真队列映射到 phone 和 faxPrefix 选项。
    与普通 IPP 作业属性不同，这些映射的传真值会绕过控制字符审查器，而是直接复制到筛选选项参数中。因此，能够提交作业的用户可将控制字符注入下游选项流。报告者指出，将这些值传递给 shell 或 modem 命令的下游传真过滤器可以 lp 身份执行代码，而维护者指出 CUPS 对机密性或完整性没有任何影响，因为唯一已知的代码执行过滤器是可选的 Foomatic，并且会单独寻址，因此可能会中断受影响的队列。此问题已在 2.4.20 版本中修复。(CVE-2026-55467)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートホストにインストールされている cups のバージョンは、2.4.19 / 2.4.20より前です。したがって、SSA: 2026-278-01 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    セキュリティの問題を修正する新しい cups パッケージが、Slackware 15.0 と最新版で利用可能です。

Tenable は、前述の記述ブロックを cups セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - OpenPrinting CUPS は、Linux およびその他の Unix 系オペレーティングシステム用のオープンソース印刷システムです。2.4.20 より前に、scheduler/job.c の cupsdCreateJob オプション文字列ビルダーは、攻撃者が制御する宛先 URI および pre-dial-string の値を、構成済みのファックスキューから電話機およびファックスプレフィックスオプションにマッピングします。
    通常の IPP ジョブ属性とは異なり、これらのマップされたファックス値はコントロール文字サニタイザーをバイパスし、フィルターオプションの引数に直接コピーされます。このため、ジョブのサブミットが許可されたユーザーは、ダウンストリームのオプションストリームに制御文字を注入できます。報告者は、これらの値をシェルまたはモデムコマンドに渡すダウンストリームのファックスフィルターは、lpとしてコードを実行する可能性があると述べています。一方、メンテナンス担当者は、CUPSには機密性または整合性の影響はありません。これは、既知のコードを実行するフィルターはオプションでFoomaticのみであり、個別にアドレス指定されるため、影響を受けるキューを混乱させる可能性があります。この問題はバージョン 2.4.20 で修正されています。(CVE-2026-55467)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The version of cups installed on the remote host is prior to 2.4.19 / 2.4.20. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-278-01 advisory.

    New cups packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled     destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options.
    Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are     copied directly into the filter options argument. A user permitted to submit a job can therefore inject     control characters into the downstream option stream. The reporter states that a downstream fax filter     passing these values to a shell or modem command could execute code as lp, while the maintainer states     that CUPS has no confidentiality or integrity impact because the only known code-executing filter is     optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue     is fixed in version 2.4.20. (CVE-2026-55467)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3415 advisory.

    An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler     accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier     passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted     as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient     value starting with - to influence sendmail behavior. Successful exploitation depends on the installed     mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands     with the privileges of the CUPS service user. (CVE-2026-105326)

    A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service     improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An     unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet     Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service     (DoS) for all printing services. (CVE-2026-107655)

    OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout     handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever     any client connection has an in-flight Send-Document operation, without matching that connection to the     job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request     containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete     jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs     is exhausted and further legitimate print submissions are rejected. The suppression ends when the held     connection closes. (CVE-2026-107885)

    OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-     Class replaces an existing class member list, add_class() frees pclass->printers without clearing the     pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class     subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete     classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
    (CVE-2026-107886)

    OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked     job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer     cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the     NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all     queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
    (CVE-2026-107888)

    OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in     job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job()     converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently     calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted     Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an     accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when     permitted by listener and access-control configuration. (CVE-2026-107890)

    A malicious or attacker-controlled IPP printer can return a crafted text printer-status attribute, such as     marker-message, containing embedded newline characters. The CUPS ipp backend reports this remote printer     attribute to the scheduler through the backend stderr/status stream. The current quoting helper escapes     quotes and backslashes, but it does not reject or encode LF/CR. As a result, attacker-controlled printer     status text can create a new backend status line beginning with PPD:.

    NOTE: https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3vNOTE: Fixed by:
    https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a (v2.4.20)     (CVE-2026-55453)

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled     destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options.
    Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are     copied directly into the filter options argument. A user permitted to submit a job can therefore inject     control characters into the downstream option stream. The reporter states that a downstream fax filter     passing these values to a shell or modem command could execute code as lp, while the maintainer states     that CUPS has no confidentiality or integrity impact because the only known code-executing filter is     optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue     is fixed in version 2.4.20. (CVE-2026-55467)

    When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls     copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile     path is fully predictable (<TempDir>/<con->number>.ppd, where con->number is the sequential client     connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) -- without O_EXCL and     without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group     that print filters run under. An lp-group process can pre-plant a symlink at thepredicted path pointing at     any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp - root     arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with     O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.

    NOTE: https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9NOTE: Fixed by:
    https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62 (v2.4.20)     (CVE-2026-55480)

    NOTE: https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5gNOTE: Fixed by:
    https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3 (v2.4.20)     (CVE-2026-61702)

    The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past     the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-     description parsing in backend/snmp-supplies.c with attacker-controlled content. (CVE-2026-87875)

    Two case-insensitive comparisons on request-derived usernames outside the main authorization path in     CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-     based access controls in certain configurations. (CVE-2026-87876)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
474880	Echo: cups: security update to 2.4.20-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/16/2026	10/21/2026	low
474880	Echo: cups: security update to 2.4.20-1	Tenable Cloud Security	Echo Local Security Checks	10/16/2026	10/21/2026	low
363018	Slackware Linux 15.0 / current cups 多個弱點（SSA：2026-278-01）	Nessus	Slackware Local Security Checks	10/5/2026	10/22/2026	medium
366394	Linux Distros 未修補弱點：CVE-2026-55467	Nessus	Misc.	10/16/2026	10/30/2026	low
363018	Slackware Linux 15.0 / 当前版本 cups 多种漏洞（SSA：2026-278-01）	Nessus	Slackware Local Security Checks	10/5/2026	10/22/2026	medium
366394	Linux Distros 未修补的漏洞：CVE-2026-55467	Nessus	Misc.	10/16/2026	10/30/2026	low
363018	Slackware Linux 15.0 /最新版の cups の複数の脆弱性(SSA:2026-278-01)	Nessus	Slackware Local Security Checks	10/5/2026	10/22/2026	medium
366394	Linux Distros のパッチ未適用の脆弱性: CVE-2026-55467	Nessus	Misc.	10/16/2026	10/30/2026	low
363018	Slackware Linux 15.0 / current cups Multiple Vulnerabilities (SSA:2026-278-01)	Nessus	Slackware Local Security Checks	10/5/2026	10/22/2026	medium
366394	Linux Distros Unpatched Vulnerability : CVE-2026-55467	Nessus	Misc.	10/16/2026	10/30/2026	low
377954	Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2026-3415)	Nessus	Amazon Linux Local Security Checks	11/9/2026	11/9/2026	medium

Detections

Analytics

Plugins Search

low

low

medium

low

medium

low

medium

low

medium

low

medium