CVS commit: pkgsrc/print

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Oct 12 15:15:34 UTC 2026

Modified Files:
        pkgsrc/print/cups: Makefile Makefile.common
        pkgsrc/print/cups-base: Makefile distinfo
        pkgsrc/print/libcups: Makefile

Log Message:
*cups*: update to 2.4.20

v2.4.20 - 2026-10-05
--------------------

- SECURITY-5.7: The scheduler did not open temporary PPD files in exclusive
  mode (CVE-2026-55480)
- SECURITY-5.5: The scheduler did not remove all job status attributes from a
  job creation request (GHSA-7j85-5r23-xhvh)
- SECURITY-5.3: The scheduler did not validate the request language value
  (CVE-2026-61702)
- SECURITY-4.6: Attribute names were not validated as proper keyword values
  (GHSA-w9hj-hq9p-m7f6)
- SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly treated UTF-32
  values as 64-bit (CVE-2026-87875)
- SECURITY-4.1: Held jobs for temporary print queues could crash the scheduler
  (GHSA-qqm8-4q5h-jg55)
- SECURITY-3.3: The backend did not sanitize IPP attribute strings
  (CVE-2026-55453)
- SECURITY-3.3: The scheduler did not filter out group separators from job
  submissions (GHSA-wjc4-qhjr-5m5x)
- SECURITY-3.0: Quota and policy operations did not treat usernames as case-
  sensitive (CVE-2026-87876)
- SECURITY-3.0: The scheduler's startup permission checks were vulnerable to
  TOU attacks (GHSA-gj33-wxpv-6fgg)
- SECURITY-2.5: The scheduler did not sanitize fax numbers (CVE-2026-55467)
- SECURITY-2.5: The 'mailto' notifier did not sanitize the recipient address
  provided to the sendmail command (CVE-2026-105326)
- SECURITY-2.3: The scheduler could crash when modifying a class
  (GHSA-pwg4-pv39-8c22)
- Increased the size of the SNMP supply name buffer used by the network backends
  (Issue #1604)
- The USB backend now clears a halt on USB errors (Issue #1606)
- Updated a few character tests for signed char platforms (Issue #1623)
- Updated dateTime parsing in IPP files (Issue #1710)
- Now explicitly limit IPP attribute names to 255 bytes (Issue #1694)
- Added validation of IPP "printer-state-reasons" and
  "printer-mandatory-job-attributes" attributes (Issue #1632)
- Added missing Set-Printer-Attributes policy to cupsd.conf.
- Removed problematic debug printfs from `dnssd` backend.
- Fixed mapping of standard PPD/PWG/legacy media size names to the local PPD
  size name (Issue #1375)
- Fixed handling of multiple PPD: keywords from filters (Issue #1562,
  related to CVE-2026-34980)
- Fixed handling of Kerberos user@REALM identities for user validation and
  quotas when StripUserDomain is not enabled (Issue #1584)
- Fixed raster error reporting overflow (Issue #1607)
- Fixed `cupsRasterInterpretPPD` handling of bad numbers (Issue #1608)
- Fixed SNMP hex string debug output (Issue #1610)
- Fixed some web interface bugs (Issue #1611)
- Fixed some compression issues in the rastertoepson and rastertohp drivers
  (Issue #1613)
- Fixed MIME `char` rule handling (Issue #1614)
- Fixed duplicate local printers (Issue #1531, Issue #1586, Issue #1593,
  Issue #1620)
- Fixed PPD cache memory leak (Issue #1629, Issue #1344)
- Fixed escaping of spaces in option values (Issue #1630)
- Fixed potential buffer overflow in `cupsCopyDestConflicts` (Issue #1631)
- Fixed backchannel parsing bug in `commandtops` filter (Issue #1637)
- Fixed section parsing in the web help indexing code (Issue #1641)
- Fixed potential buffer overrun in rastertolabel filter (Issue #1644)
- Fixed potential buffer overrun in rastertohp filter (Issue #1650)
- Fixed media selection with a mix of PPD and IPP options (Issue #1651)
- Fixed potential access of deleted IPP Everywhere printer (Issue #1655)
- Fixed limiting of PPD custom number output for large numbers (Issue #1656)
- Fixed a potential output length bug in the rastertohp driver (Issue #1658)
- Fixed a potential buffer underflow buf in the `ippAdd/SetStringf(v)` functions
  (Issue #1664)
- Fixed handling of TLS system priorities (Issue #1677)
- Fixed D-Bus notification policy definition (Issue #1691)
- Fixed raster fallback for IPP Everywhere printers (Issue #1703)
- Fixed potential SNMP OID side-channel overflow (Issue #1719)
- Fixed potential scheduler printer use-after-free bug (Issue #1722)
- Fixed several issues reported by Coverity
- Fixed case-sensitive PPD keyword comparisons when filtering keyword updates
  from filters.
- Fixed potential buffer overrun in `cupsDoAuthentication`.


To generate a diff of this commit:
cvs rdiff -u -r1.306 -r1.307 pkgsrc/print/cups/Makefile
cvs rdiff -u -r1.29 -r1.30 pkgsrc/print/cups/Makefile.common
cvs rdiff -u -r1.88 -r1.89 pkgsrc/print/cups-base/Makefile
cvs rdiff -u -r1.50 -r1.51 pkgsrc/print/cups-base/distinfo
cvs rdiff -u -r1.53 -r1.54 pkgsrc/print/libcups/Makefile

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/print/cups/Makefile
diff -u pkgsrc/print/cups/Makefile:1.306 pkgsrc/print/cups/Makefile:1.307
--- pkgsrc/print/cups/Makefile:1.306    Tue Sep 29 06:07:12 2026
+++ pkgsrc/print/cups/Makefile  Mon Oct 12 15:15:34 2026
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.306 2026/09/29 06:07:12 wiz Exp $
+# $NetBSD: Makefile,v 1.307 2026/10/12 15:15:34 wiz Exp $
 
-PKGREVISION= 4
 .include "../../print/cups/Makefile.common"
 
 PKGNAME=       cups-${CUPS_VERS}

Index: pkgsrc/print/cups/Makefile.common
diff -u pkgsrc/print/cups/Makefile.common:1.29 pkgsrc/print/cups/Makefile.common:1.30
--- pkgsrc/print/cups/Makefile.common:1.29      Sun May  3 14:29:18 2026
+++ pkgsrc/print/cups/Makefile.common   Mon Oct 12 15:15:34 2026
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile.common,v 1.29 2026/05/03 14:29:18 wiz Exp $
+# $NetBSD: Makefile.common,v 1.30 2026/10/12 15:15:34 wiz Exp $
 #
 # used by print/cups/Makefile
 # used by print/cups-base/Makefile
 # used by print/libcups/Makefile
 
-CUPS_VERS=     2.4.19
+CUPS_VERS=     2.4.20
 DISTNAME=      cups-${CUPS_VERS}-source
 CATEGORIES=    print
 

Index: pkgsrc/print/cups-base/Makefile
diff -u pkgsrc/print/cups-base/Makefile:1.88 pkgsrc/print/cups-base/Makefile:1.89
--- pkgsrc/print/cups-base/Makefile:1.88        Tue Sep 29 06:07:12 2026
+++ pkgsrc/print/cups-base/Makefile     Mon Oct 12 15:15:34 2026
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.88 2026/09/29 06:07:12 wiz Exp $
+# $NetBSD: Makefile,v 1.89 2026/10/12 15:15:34 wiz Exp $
 
-PKGREVISION= 4
 .include "../../print/cups/Makefile.common"
 
 PKGNAME=       cups-base-${CUPS_VERS}

Index: pkgsrc/print/cups-base/distinfo
diff -u pkgsrc/print/cups-base/distinfo:1.50 pkgsrc/print/cups-base/distinfo:1.51
--- pkgsrc/print/cups-base/distinfo:1.50        Sun May  3 14:29:18 2026
+++ pkgsrc/print/cups-base/distinfo     Mon Oct 12 15:15:34 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.50 2026/05/03 14:29:18 wiz Exp $
+$NetBSD: distinfo,v 1.51 2026/10/12 15:15:34 wiz Exp $
 
-BLAKE2s (cups-2.4.19-source.tar.gz) = 4e7e7745a71c8b2d5554e2177ca698a34fff2ecfcdd219bc364afcc4fea85368
-SHA512 (cups-2.4.19-source.tar.gz) = 3d7f7bd448afc54011e98cc3f6a6cfe704bdae58a1e0cdde19f95ed0b4956b518c6e0a64277c99daa38b26d3ddf23033a4135cc21c3e5d7602731789024fa287
-Size (cups-2.4.19-source.tar.gz) = 7950335 bytes
+BLAKE2s (cups-2.4.20-source.tar.gz) = 806705e9e81cd6aa3ac028d87e609b67131f1caf31c13fb31d1413e1b3e93079
+SHA512 (cups-2.4.20-source.tar.gz) = 50be40e33662b32514ef7026a86c80970b2122fd187f32f4b704293468e615c1fcd6eb6575992f84856012a01b0e599a524ac6dd8630d073144b50cc5d6bd683
+Size (cups-2.4.20-source.tar.gz) = 8164882 bytes
 SHA1 (patch-ae) = 7f12aa886208f9e634d5c3fd3bc1fd4a385f22a6
 SHA1 (patch-ai) = d4aa1b59c77fa2cbf614eb661d9a791311b399c2
 SHA1 (patch-at) = 9517bff0bf2c892f0723a25f243ba188f7781393

Index: pkgsrc/print/libcups/Makefile
diff -u pkgsrc/print/libcups/Makefile:1.53 pkgsrc/print/libcups/Makefile:1.54
--- pkgsrc/print/libcups/Makefile:1.53  Tue Sep 29 06:07:15 2026
+++ pkgsrc/print/libcups/Makefile       Mon Oct 12 15:15:34 2026
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.53 2026/09/29 06:07:15 wiz Exp $
+# $NetBSD: Makefile,v 1.54 2026/10/12 15:15:34 wiz Exp $
 
-PKGREVISION= 4
 .include "../../print/cups/Makefile.common"
 
 PKGNAME=       libcups-${CUPS_VERS}