Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

A buffer overflow flaw was discovered in the SGI image format decoding routines used by the CUPS image converting filter 'imagetops'. An attacker could create a malicious SGI image file that could, possibly, execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-3639)

An integer overflow flaw leading to a heap buffer overflow was discovered in the Text-to-PostScript 'texttops' filter. An attacker could create a malicious text file that could, possibly, execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-3640)

An insufficient buffer bounds checking flaw was discovered in the HP-GL/2-to-PostScript 'hpgltops' filter. An attacker could create a malicious HP-GL/2 file that could, possibly, execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-3641)

Red Hat would like to thank regenrecht for reporting these issues.

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The previous CUPS security advisor, stated that it fixed CVE-2008-3640 for Scientific Linux 3, 4, and 5. It was discovered this flaw was not properly fixed on Scientific Linux 3, however. (CVE-2009-0577)

These new packages contain a proper fix for CVE-2008-3640 on Scientific Linux 3. Scientific Linux 4 and 5 already contain the appropriate fix for this flaw and do not need to be updated.

New cups packages are available for Slackware 12.0, 12.1, and
-current to fix security issues.

Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX(r) Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

The CUPS security advisory, RHSA-2008:0937, stated that it fixed CVE-2008-3640 for Red Hat Enterprise Linux 3, 4, and 5. It was discovered this flaw was not properly fixed on Red Hat Enterprise Linux 3, however. (CVE-2009-0577)

These new packages contain a proper fix for CVE-2008-3640 on Red Hat Enterprise Linux 3. Red Hat Enterprise Linux 4 and 5 already contain the appropriate fix for this flaw and do not need to be updated.

Users of cups should upgrade to these updated packages, which contain a backported patch to correct this issue.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0028 advisory.

    This advisory aggregates security fixes for the cups SRPM in CIQ LTS 8.6. It addresses 40 CVEs:
    CVE-2010-0540, CVE-2018-4181, CVE-2007-5393, CVE-2020-3898, CVE-2010-0302, and 35 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
34384	RHEL 3 / 4 / 5 : cups (RHSA-2008:0937)	Nessus	Red Hat Local Security Checks	2008/10/10	2021/1/14	critical
60536	Scientific Linux Security Update : cups on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
34719	Slackware 12.0 / 12.1 / current : cups (SSA:2008-312-01)	Nessus	Slackware Local Security Checks	2008/11/9	2021/1/14	critical
35719	CentOS 3 / 4 : cups (CESA-2009:0308)	Nessus	CentOS Local Security Checks	2009/2/20	2021/1/4	medium
358501	Rocky Linux 8.6 [CIQ] Security Update: cups / cups-client / cups-client-debuginfo / cups-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0028)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

検出

プラグインの検索

critical

medium

critical

medium

critical