rpms/cups
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix use-after-free reported by OSH

Browse Source 
Resolves: RHEL-129723
This commit is contained in:
Zdenek Dohnal 2025-12-12 10:08:24 +01:00
parent dfe48aa41e
commit 128c42b262
2 changed files with 38 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch Normal file
View File

@ -0,0 +1,29 @@
From c1d2c631267f28131dd31df5b895b8bfb3005b0d Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 11 Dec 2025 15:12:55 +0100
Subject: [PATCH] scheduler: Fix possible use_after_free in `cupsdReadClient()`
If `cupsdSendHeader()` fails, we free the connection and return -1, but
in that case we try to free the connection again in `cupsdReadClient()`.
---
scheduler/client.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/scheduler/client.c b/scheduler/client.c
index f6166091e..63844d531 100644
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -2761,10 +2761,7 @@ check_start_tls(cupsd_client_t *con) /* I - Client connection */
httpSetField(con->http, HTTP_FIELD_CONTENT_LENGTH, "0");
if (!cupsdSendHeader(con, HTTP_STATUS_OK, NULL, CUPSD_AUTH_NONE))
- {
- cupsdCloseClient(con);
return (-1);
- }
}
return (1);
--
2.52.0

10
cups.spec
View File

@ -22,7 +22,7 @@ Summary: CUPS printing system
Name: cups
Epoch: 1
Version: 2.4.10
Release: 15%{?dist}
Release: 16%{?dist}
# backend/failover.c - BSD-3-Clause
# cups/md5* - Zlib
# scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
@ -124,6 +124,9 @@ Patch1019: 0001-Fix-an-infinite-loop-issue-in-GTK-Issue-1439.patch
# 0001-conf.c-Fix-stopping-scheduler-on-unknown-directive.patch
Patch1020: 0001-Fix-various-issues-in-cupsd.patch
Patch1021: 0001-conf.c-Fix-stopping-scheduler-on-unknown-directive.patch
# fix use-after-free reported after fix for CVE-2025-58436
# https://github.com/OpenPrinting/cups/pull/1454
Patch1022: 0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch
##### Patches removed because IMHO they aren't no longer needed
@ -396,6 +399,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
# RHEL-129716 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues
%patch -P 1020 -p1 -b .config-issues
%patch -P 1021 -p1 -b .ignore-unknown
# fix use-after-free reported after fix for CVE-2025-58436
%patch -P 1022 -p1 -b .osh-use-after-free
# Log to the system journal by default (bug #1078781, bug #1519331).
@ -867,6 +872,9 @@ rm -f %{cups_serverbin}/backend/smb
%{_mandir}/man7/ippeveps.7.gz
%changelog
* Fri Dec 12 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-16
- fix use-after-free reported by OSH
* Thu Nov 27 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-15
- RHEL-129723 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
- RHEL-129716 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues