git: 29e24be90428 - main - security/vuxml: Document CUPS vulnerabilities

From: Tijl Coosemans <tijl_at_FreeBSD.org>
Date: Tue, 16 Sep 2025 07:27:21 UTC 
The branch main has been updated by tijl:

URL: https://cgit.FreeBSD.org/ports/commit/?id=29e24be904285c8ad259c6340cdef805c07e1281

commit 29e24be904285c8ad259c6340cdef805c07e1281
Author:     Tijl Coosemans <tijl@FreeBSD.org>
AuthorDate: 2025-09-16 07:24:15 +0000
Commit:     Tijl Coosemans <tijl@FreeBSD.org>
CommitDate: 2025-09-16 07:24:15 +0000

    security/vuxml: Document CUPS vulnerabilities
    
    CVE-2025-58060 cups: Authentication bypass with AuthType Negotiate
    CVE-2025-58364 cups: Remote DoS via null dereference
---
 security/vuxml/vuln/2025.xml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 63d238dd8725..632514941d84 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,36 @@
+  <vuln vid="b959f00c-92cc-11f0-a064-74563cf9e4e9">
+    <topic>CUPS -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>cups</name>
+	<range><lt>2.4.13</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>OpenPrinting reports:</p>
+	<blockquote cite="https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq">
+	  <p>When the AuthType is set to anything but Basic, if the request contains an
+	    Authorization: Basic ... header, the password is not checked.</p>
+	</blockquote>
+	<blockquote cite="https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4">
+	  <p>An unsafe deserialization and validation of printer attributes, causes null
+	    dereference in libcups library.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-58060</cvename>
+      <cvename>CVE-2025-58364</cvename>
+      <url>https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq</url>
+      <url>https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4</url>
+    </references>
+    <dates>
+      <discovery>2025-09-11</discovery>
+      <entry>2025-09-16</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="f6ca7c47-9190-11f0-b8da-589cfc10a551">
     <topic>unit-java -- security vulnerability</topic>
     <affects>