Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Oracle CUPS can let attackers schedule jobs without login

published 3 months ago

Summary

The Oracle CUPS printing system and its related packages could be tricked into accepting scheduling commands without checking the user’s credentials. This could allow an attacker to add, change, or cancel print jobs and potentially disrupt services. Apply the latest security update from Oracle as soon as possible to close the gap.

What to do

Update oracle cups to version 1:1.4.2-81.el6_10.tuxcare.els4.
Update oracle cups-devel to version 1:1.4.2-81.el6_10.tuxcare.els4.
Update oracle cups-libs to version 1:1.4.2-81.el6_10.tuxcare.els4.
Update oracle cups-lpd to version 1:1.4.2-81.el6_10.tuxcare.els4.
Update oracle cups-php to version 1:1.4.2-81.el6_10.tuxcare.els4.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:OracleLinux:6	oracle	cups	< 1:1.4.2-81.el6_10.tuxcare.els4 Fix: upgrade to 1:1.4.2-81.el6_10.tuxcare.els4
TuxCare:OracleLinux:6	oracle	cups-devel	< 1:1.4.2-81.el6_10.tuxcare.els4 Fix: upgrade to 1:1.4.2-81.el6_10.tuxcare.els4
TuxCare:OracleLinux:6	oracle	cups-libs	< 1:1.4.2-81.el6_10.tuxcare.els4 Fix: upgrade to 1:1.4.2-81.el6_10.tuxcare.els4
TuxCare:OracleLinux:6	oracle	cups-lpd	< 1:1.4.2-81.el6_10.tuxcare.els4 Fix: upgrade to 1:1.4.2-81.el6_10.tuxcare.els4
TuxCare:OracleLinux:6	oracle	cups-php	< 1:1.4.2-81.el6_10.tuxcare.els4 Fix: upgrade to 1:1.4.2-81.el6_10.tuxcare.els4

Original advisory text

cups: Fix of CVE-2025-58060

- CVE-2025-58060: fix authentication bypass in the scheduler by blocking
authentication attempts using a method other than the configured AuthType

References

https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1785852573.html Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58060 Vendor Advisory

Timeline

Published4 Aug 2026

Updated26 Oct 2026

First seen26 Oct 2026

Sources

CLSA-2026-1785852573 · OSV

Track software like this

Free during beta