CUPS Flaws Allow Linux Remote DoS (CVE-2025-58364) and Authentication Bypass (CVE-2025-58060)

OpenPrinting has released patches addressing two security flaws in the Common Unix Printing System (CUPS), tracked as CVE-2025-58364 and CVE-2025-58060, affecting multiple versions of CUPS and cups-browsed and exposing systems to remote DoS and authentication bypass threats.

According to the advisory, CVE-2025-58364 stems from unsafe deserialization and validation of printer attributes in the libcups library, with a null pointer dereference that can be triggered by crafted printer attribute responses from attackers on the same subnet. The vulnerability can cause cups and cups-browsed to crash, disrupting printing services on Linux desktops and servers, and could affect systems exposed to the internet if older unfixed vulnerabilities are present.

CVE-2025-58060 enables authentication bypass when AuthType is not Basic and an Authorization: Basic header is present, potentially allowing attackers to perform administrative actions without valid credentials. Affected versions include CUPS <2.4.12 for CVE-2025-58364 and CUPS <2.4.13 for CVE-2025-58060, with fixes in CUPS 2.4.14, which administrators are urged to deploy.