openSUSE 16 Security Update : cups-filters (openSUSE-SU-2026:21850-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21850-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(346187);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/16");

  script_cve_id(
    "CVE-2024-47076",
    "CVE-2024-47175",
    "CVE-2024-47176",
    "CVE-2024-47850",
    "CVE-2026-64611",
    "CVE-2026-64612"
  );

  script_name(english:"openSUSE 16 Security Update : cups-filters (openSUSE-SU-2026:21850-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21850-1 advisory.

    Changes in cups-filters:

    - CVE-2026-64611: Fixed Infinite-loop CPU-exhaustion DoS in
       cfIEEE1284NormalizeMakeModel on empty MDL field.
      A user who controls an IEEE-1284 device ID consumed by
       `cfIEEE1284GetMakeModel` can drive
       `cfIEEE1284NormalizeMakeModel` into an infinite loop.
      (bsc#1273145,GHSA-rcq7-rv5g-j3r4)

    - CVE-2026-64612: Fixed Malformed PNG aborts CUPS image filter process
       (missing libpng setjmp recovery)
      A authenticated client that can submit an image print job
       can abort the CUPS filter process by supplying a malformed PNG.
      (bsc#1273146,GHSA-7mxj-cfq5-84ch)

    - Provide cups-browsed as separated cups-filters-cups-browsed
      sub-package so users can uninstall this sub-package
      to completely avoid the generic security risk of cups-browsed.
      cups-browsed auto-creates local print queues for printers which
      are announced via DNS-SD. It is a generic security risk when a
      service (cups-browsed.service) accepts any (possibly malicious)
      incoming information from any host in the local network
      (i.e. any DNS-SD announcements) and from that information
      it auto-creates print queue configurations for CUPS
      (where its server program cupsd runs as root).
      For more information see the openSUSE support database article
      https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

    - Fixed a regression Error about PPD file during 'driverless' printer setup
      (boo#1256868) and ppd pull out from [driverless] printer feature broken
      (bsc#1256977)

    - unbreak qpdf [bsc#1253678]

    - CVE-2024-47176: Fixed cups-browsed binds to UDP INADDR_ANY:631 (bsc#1230939)
      and to avoid CVE-2024-47850 cups-browsed can be abused to
      initiate remote DDoS against third-party targets (bsc#1231294)
      by removing legacy CUPS Browsing support in cups-browsed
      (introduced 2012) which is no longer needed nowadays.
      CUPS browsing was removed from CUPS since version 1.6.
      Legacy CUPS Browsing is a generic security risk, see the
      section Automated print queue setup via cups-browsed in
      https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

    - CVE-2024-47076: Fixed lack of input sanitization in cfGetPrinterAttributes5 (bsc#1230937)

    - CVE-2024-47175: Fixed lack of input sanitization in _ppdCreateFromIPP() (bsc#1230932)

    - In general regarding CUPS and cups-browsed security issues see
      https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1230932");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1230937");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1230939");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1231294");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1253678");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1256868");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1256977");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273145");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1273146");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2024-47076");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2024-47175");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2024-47176");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2024-47850");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-64611");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-64612");
  script_set_attribute(attribute:"solution", value:
"Update the affected cups-filters, cups-filters-cups-browsed and / or cups-filters-devel packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47175");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-cups-browsed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'cups-filters-1.28.17-bp160.2.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'cups-filters-cups-browsed-1.28.17-bp160.2.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'cups-filters-devel-1.28.17-bp160.2.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cups-filters / cups-filters-cups-browsed / cups-filters-devel');
}