Ubuntu USN · USN-8405-2

CUPS regression

Published: Mon, 15 Jun 2026 12:12

Summary

USN-8405-1 introduced a regression in CUPS

Details

USN-8405-1 fixed vulnerabilities in CUPS. The update introduced a regression that cause CUPS to crash when parsing certain large printer PPD files. This update fixes the problem. Original advisory details: Ariel Silver discovered that CUPS incorrectly handled username comparisons during authorization checks. A local attacker could possibly use this issue to gain unauthorized access to restricted operations. (CVE-2026-27447) Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled notify-recipient-uri values in the RSS notifier. A remote attacker could possibly use this issue to overwrite lp-writable files and cause a denial of service. (CVE-2026-34978) Jacob Newman discovered that CUPS incorrectly handled filter option strings when processing job attributes. An attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-34979) Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled page-border values in shared PostScript queues. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-34980) Asim Viladi Oglu Manizada discovered that CUPS incorrectly handled localhost authentication to attacker-controlled IPP services. A local attacker could possibly use this issue to overwrite arbitrary files and execute arbitrary code. (CVE-2026-34990) Tomer Fichman discovered that CUPS incorrectly handled negative job-password-supported values. A local attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service. (CVE-2026-39314) Tomer Fichman discovered that CUPS incorrectly handled temporary printer deletion. An attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service, or to execute arbitrary code. (CVE-2026-39316) Tomer Fichman discovered that CUPS incorrectly handled certain malformed SNMP responses. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-41079)

Recommended actions per Ubuntu release

StackPatch playbook auto-generated per release codename and per affected package.

Ubuntu jammy

cups→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-bsd→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-bsd
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-client→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-client
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-common→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-core-drivers→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-core-drivers
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-daemon→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-daemon
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ipp-utils→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ipp-utils
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ppdc→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ppdc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-server-common→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-server-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2-dev→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2-dev→2.4.1op1-1ubuntu4.21apt_upgrade
Standard apt upgrade. Install 2.4.1op1-1ubuntu4.21 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu noble

cups→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-bsd→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-bsd
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-client→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-client
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-common→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-core-drivers→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-core-drivers
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-daemon→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-daemon
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ipp-utils→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ipp-utils
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ppdc→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ppdc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-server-common→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-server-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2-dev→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2t64→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2-dev→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2t64→2.4.7-1.2ubuntu7.14apt_upgrade
Standard apt upgrade. Install 2.4.7-1.2ubuntu7.14 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu questing

cups→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-bsd→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-bsd
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-client→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-client
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-common→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-core-drivers→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-core-drivers
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-daemon→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-daemon
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ipp-utils→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ipp-utils
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ppdc→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ppdc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-server-common→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-server-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2-dev→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2t64→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2-dev→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2t64→2.4.12-0ubuntu3.10apt_upgrade
Standard apt upgrade. Install 2.4.12-0ubuntu3.10 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu resolute

cups→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-bsd→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-bsd
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-client→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-client
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-common→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-core-drivers→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-core-drivers
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-daemon→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-daemon
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ipp-utils→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ipp-utils
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-ppdc→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-ppdc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
cups-server-common→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y cups-server-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2-dev→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcups2t64→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcups2t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2-dev→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libcupsimage2t64→2.4.16-1ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2.4.16-1ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libcupsimage2t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Are YOU affected by USN-8405-2?

5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether USN-8405-2 (and any other live CVE) applies. Anonymous, no signup.

curl https://mindsparkstack.com/scan.sh | bash

Form-based quickscan Read the bash source first

References

Want this automated for your servers?

StackPatch runs this match against YOUR installed packages every hour

Free 1-server / $99 lifetime founder seat (50 only) / $19+/mo monthly. Indie pricing.

Buy lifetime →See StackPatch →Live audit log →