SUSE update for cups
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2025-58436 CVE-2025-61915 |
| CWE-ID | CWE-400 CWE-787 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Basesystem Module Operating systems & Components / Operating system Desktop Applications Module Operating systems & Components / Operating system Development Tools Module Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Linux Enterprise Micro for Rancher Operating systems & Components / Operating system libcupsppdc1-32bit Operating systems & Components / Operating system package or component libcupsimage2-32bit-debuginfo Operating systems & Components / Operating system package or component libcups2-32bit Operating systems & Components / Operating system package or component libcupsmime1-32bit-debuginfo Operating systems & Components / Operating system package or component libcupsmime1-32bit Operating systems & Components / Operating system package or component libcups2-32bit-debuginfo Operating systems & Components / Operating system package or component libcupscgi1-32bit-debuginfo Operating systems & Components / Operating system package or component libcupsimage2-32bit Operating systems & Components / Operating system package or component libcupscgi1-32bit Operating systems & Components / Operating system package or component libcupsppdc1-32bit-debuginfo Operating systems & Components / Operating system package or component cups-devel-32bit Operating systems & Components / Operating system package or component cups-ddk Operating systems & Components / Operating system package or component libcupscgi1-debuginfo Operating systems & Components / Operating system package or component cups Operating systems & Components / Operating system package or component libcupsmime1 Operating systems & Components / Operating system package or component cups-client Operating systems & Components / Operating system package or component cups-config Operating systems & Components / Operating system package or component libcupsppdc1-debuginfo Operating systems & Components / Operating system package or component libcupscgi1 Operating systems & Components / Operating system package or component libcups2-debuginfo Operating systems & Components / Operating system package or component cups-devel Operating systems & Components / Operating system package or component cups-debuginfo Operating systems & Components / Operating system package or component libcupsppdc1 Operating systems & Components / Operating system package or component libcupsmime1-debuginfo Operating systems & Components / Operating system package or component libcupsimage2-debuginfo Operating systems & Components / Operating system package or component libcupsimage2 Operating systems & Components / Operating system package or component libcups2 Operating systems & Components / Operating system package or component cups-ddk-debuginfo Operating systems & Components / Operating system package or component cups-client-debuginfo Operating systems & Components / Operating system package or component cups-debugsource Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Resource exhaustion
EUVDB-ID: #VU118818
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-58436
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when handling delays. A local user can send slow messages to cupsd with a delay of 1 byte per second, causing the daemon to consume excessive resources.
MitigationUpdate the affected package cups to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP6 - 15-SP7
Desktop Applications Module: 15-SP6 - 15-SP7
Development Tools Module: 15-SP6 - 15-SP7
SUSE Linux Enterprise Real Time 15: SP6 - SP7
SUSE Linux Enterprise Server for SAP Applications 15: SP6 - SP7
SUSE Linux Enterprise Server 15: SP6 - SP7
SUSE Linux Enterprise Desktop 15: SP6 - SP7
openSUSE Leap: 15.6
SUSE Linux Enterprise Micro: 5.2 - 5.5
SUSE Linux Enterprise Micro for Rancher: 5.2 - 5.4
libcupsppdc1-32bit: before 2.2.7-150000.3.77.1
libcupsimage2-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcups2-32bit: before 2.2.7-150000.3.77.1
libcupsmime1-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcupsmime1-32bit: before 2.2.7-150000.3.77.1
libcups2-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcupscgi1-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcupsimage2-32bit: before 2.2.7-150000.3.77.1
libcupscgi1-32bit: before 2.2.7-150000.3.77.1
libcupsppdc1-32bit-debuginfo: before 2.2.7-150000.3.77.1
cups-devel-32bit: before 2.2.7-150000.3.77.1
cups-ddk: before 2.2.7-150000.3.77.1
libcupscgi1-debuginfo: before 2.2.7-150000.3.77.1
cups: before 2.2.7-150000.3.77.1
libcupsmime1: before 2.2.7-150000.3.77.1
cups-client: before 2.2.7-150000.3.77.1
cups-config: before 2.2.7-150000.3.77.1
libcupsppdc1-debuginfo: before 2.2.7-150000.3.77.1
libcupscgi1: before 2.2.7-150000.3.77.1
libcups2-debuginfo: before 2.2.7-150000.3.77.1
cups-devel: before 2.2.7-150000.3.77.1
cups-debuginfo: before 2.2.7-150000.3.77.1
libcupsppdc1: before 2.2.7-150000.3.77.1
libcupsmime1-debuginfo: before 2.2.7-150000.3.77.1
libcupsimage2-debuginfo: before 2.2.7-150000.3.77.1
libcupsimage2: before 2.2.7-150000.3.77.1
libcups2: before 2.2.7-150000.3.77.1
cups-ddk-debuginfo: before 2.2.7-150000.3.77.1
cups-client-debuginfo: before 2.2.7-150000.3.77.1
cups-debugsource: before 2.2.7-150000.3.77.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:development_tools_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:development_tools_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro_for_rancher:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libcupsppdc1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsppdc1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-devel-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-ddk:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsppdc1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsppdc1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-ddk-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-client-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-debugsource:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20254290-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds write
EUVDB-ID: #VU118817
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-61915
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when parsing IPv6 address within the get_addr_and_mask() function. A local user in the lpadmin group can use the cups web UI to change the configuration and crash the daemon.
MitigationUpdate the affected package cups to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP6 - 15-SP7
Desktop Applications Module: 15-SP6 - 15-SP7
Development Tools Module: 15-SP6 - 15-SP7
SUSE Linux Enterprise Real Time 15: SP6 - SP7
SUSE Linux Enterprise Server for SAP Applications 15: SP6 - SP7
SUSE Linux Enterprise Server 15: SP6 - SP7
SUSE Linux Enterprise Desktop 15: SP6 - SP7
openSUSE Leap: 15.6
SUSE Linux Enterprise Micro: 5.2 - 5.5
SUSE Linux Enterprise Micro for Rancher: 5.2 - 5.4
libcupsppdc1-32bit: before 2.2.7-150000.3.77.1
libcupsimage2-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcups2-32bit: before 2.2.7-150000.3.77.1
libcupsmime1-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcupsmime1-32bit: before 2.2.7-150000.3.77.1
libcups2-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcupscgi1-32bit-debuginfo: before 2.2.7-150000.3.77.1
libcupsimage2-32bit: before 2.2.7-150000.3.77.1
libcupscgi1-32bit: before 2.2.7-150000.3.77.1
libcupsppdc1-32bit-debuginfo: before 2.2.7-150000.3.77.1
cups-devel-32bit: before 2.2.7-150000.3.77.1
cups-ddk: before 2.2.7-150000.3.77.1
libcupscgi1-debuginfo: before 2.2.7-150000.3.77.1
cups: before 2.2.7-150000.3.77.1
libcupsmime1: before 2.2.7-150000.3.77.1
cups-client: before 2.2.7-150000.3.77.1
cups-config: before 2.2.7-150000.3.77.1
libcupsppdc1-debuginfo: before 2.2.7-150000.3.77.1
libcupscgi1: before 2.2.7-150000.3.77.1
libcups2-debuginfo: before 2.2.7-150000.3.77.1
cups-devel: before 2.2.7-150000.3.77.1
cups-debuginfo: before 2.2.7-150000.3.77.1
libcupsppdc1: before 2.2.7-150000.3.77.1
libcupsmime1-debuginfo: before 2.2.7-150000.3.77.1
libcupsimage2-debuginfo: before 2.2.7-150000.3.77.1
libcupsimage2: before 2.2.7-150000.3.77.1
libcups2: before 2.2.7-150000.3.77.1
cups-ddk-debuginfo: before 2.2.7-150000.3.77.1
cups-client-debuginfo: before 2.2.7-150000.3.77.1
cups-debugsource: before 2.2.7-150000.3.77.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:development_tools_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:development_tools_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro_for_rancher:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libcupsppdc1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsppdc1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-devel-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-ddk:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsppdc1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupscgi1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsppdc1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsmime1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcupsimage2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcups2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-ddk-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-client-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cups-debugsource:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20254290-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
