Log message:
*cups*: update to 2.4.20

v2.4.20 - 2026-10-05
--------------------

- SECURITY-5.7: The scheduler did not open temporary PPD files in exclusive
  mode (CVE-2026-55480)
- SECURITY-5.5: The scheduler did not remove all job status attributes from a
  job creation request (GHSA-7j85-5r23-xhvh)
- SECURITY-5.3: The scheduler did not validate the request language value
  (CVE-2026-61702)
- SECURITY-4.6: Attribute names were not validated as proper keyword values
  (GHSA-w9hj-hq9p-m7f6)
- SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly treated UTF-32
  values as 64-bit (CVE-2026-87875)
- SECURITY-4.1: Held jobs for temporary print queues could crash the scheduler
  (GHSA-qqm8-4q5h-jg55)
- SECURITY-3.3: The backend did not sanitize IPP attribute strings
  (CVE-2026-55453)
- SECURITY-3.3: The scheduler did not filter out group separators from job
  submissions (GHSA-wjc4-qhjr-5m5x)
- SECURITY-3.0: Quota and policy operations did not treat usernames as case-
  sensitive (CVE-2026-87876)
- SECURITY-3.0: The scheduler's startup permission checks were vulnerable to
  TOU attacks (GHSA-gj33-wxpv-6fgg)
- SECURITY-2.5: The scheduler did not sanitize fax numbers (CVE-2026-55467)
- SECURITY-2.5: The 'mailto' notifier did not sanitize the recipient \ 
address
  provided to the sendmail command (CVE-2026-105326)
- SECURITY-2.3: The scheduler could crash when modifying a class
  (GHSA-pwg4-pv39-8c22)
- Increased the size of the SNMP supply name buffer used by the network backends
  (Issue #1604)
- The USB backend now clears a halt on USB errors (Issue #1606)
- Updated a few character tests for signed char platforms (Issue #1623)
- Updated dateTime parsing in IPP files (Issue #1710)
- Now explicitly limit IPP attribute names to 255 bytes (Issue #1694)
- Added validation of IPP "printer-state-reasons" and
  "printer-mandatory-job-attributes" attributes (Issue #1632)
- Added missing Set-Printer-Attributes policy to cupsd.conf.
- Removed problematic debug printfs from `dnssd` backend.
- Fixed mapping of standard PPD/PWG/legacy media size names to the local PPD
  size name (Issue #1375)
- Fixed handling of multiple PPD: keywords from filters (Issue #1562,
  related to CVE-2026-34980)
- Fixed handling of Kerberos user@REALM identities for user validation and
  quotas when StripUserDomain is not enabled (Issue #1584)
- Fixed raster error reporting overflow (Issue #1607)
- Fixed `cupsRasterInterpretPPD` handling of bad numbers (Issue #1608)
- Fixed SNMP hex string debug output (Issue #1610)
- Fixed some web interface bugs (Issue #1611)
- Fixed some compression issues in the rastertoepson and rastertohp drivers
  (Issue #1613)
- Fixed MIME `char` rule handling (Issue #1614)
- Fixed duplicate local printers (Issue #1531, Issue #1586, Issue #1593,
  Issue #1620)
- Fixed PPD cache memory leak (Issue #1629, Issue #1344)
- Fixed escaping of spaces in option values (Issue #1630)
- Fixed potential buffer overflow in `cupsCopyDestConflicts` (Issue #1631)
- Fixed backchannel parsing bug in `commandtops` filter (Issue #1637)
- Fixed section parsing in the web help indexing code (Issue #1641)
- Fixed potential buffer overrun in rastertolabel filter (Issue #1644)
- Fixed potential buffer overrun in rastertohp filter (Issue #1650)
- Fixed media selection with a mix of PPD and IPP options (Issue #1651)
- Fixed potential access of deleted IPP Everywhere printer (Issue #1655)
- Fixed limiting of PPD custom number output for large numbers (Issue #1656)
- Fixed a potential output length bug in the rastertohp driver (Issue #1658)
- Fixed a potential buffer underflow buf in the `ippAdd/SetStringf(v)` functions
  (Issue #1664)
- Fixed handling of TLS system priorities (Issue #1677)
- Fixed D-Bus notification policy definition (Issue #1691)
- Fixed raster fallback for IPP Everywhere printers (Issue #1703)
- Fixed potential SNMP OID side-channel overflow (Issue #1719)
- Fixed potential scheduler printer use-after-free bug (Issue #1722)
- Fixed several issues reported by Coverity
- Fixed case-sensitive PPD keyword comparisons when filtering keyword updates
  from filters.
- Fixed potential buffer overrun in `cupsDoAuthentication`.

Log message:
*: recursive bump for pcre2 10.49

Log message:
*: revbump for pcre2 symbol versioning change

Log message:
*: recursive bump for pcre2 10.48

Log message:
*: Recursive revbump from security/nettle-4.0

Log message:
*cups*: update to 2.4.17

Changes in CUPS v2.4.17 (2026-04-17)
------------------------------------

- CVE-2026-27447: The scheduler treated local user and group names as case-
  insensitive.
- CVE-2026-34978: The RSS notifier could write outside the scheduler's RSS
  directory.
- CVE-2026-34980: The scheduler did not filter control characters from option
  values.
- CVE-2026-34979: The scheduler did not always allocate enough memory for a
  job's options string.
- CVE-2026-34990: The scheduler incorrectly allowed local certificates over the
  loopback interface.
- CVE-2026-39314: Fixed the range check for job password strings.
- CVE-2026-39316: Fixed a printer subscription bug in the scheduler.
- CVE-2026-NNNNN: Fixed a SNMP string conversion bug in the backends.
- The scheduler followed symbolic links when cleaning out its temporary
  directory (Issue #1448)
- Updated `cupsFileGetConf` and `cupsFilePutConf` to escape more characters.
- Updated man page `cancel` (Issue #984)
- Updated `cupsRasterReadHeader` to validate more of the page header values
  (Issue #1501)
- Fixed an issue with the class/printer CGI name checking.
- Fixed infinite loop in `http_write()` on busy print servers (Issue #827)
- Fixed potential TLS blocking issues (Issue #1128)
- Fixed a job history bug in the scheduler (Issue #1440)
- Fixed notifier logging bug that would result in nul bytes getting into the
  log (Issue #1450)
- Fixed possible use-after-free in `cupsdReadClient()` (Issue #1454)
- Fixed a document format bug in the IPP backend (Issue #1457)
- Fixed DRAIN_OUTPUT race condition (Issue #1461)
- Fixed a bug when then `ippFindXxx` and `ippSetXxx` functions were mixed.
- Fixed the mapping of supply type keywords to SNMP names.
- Fixed a bug in the IPP backend when SNMP was disabled.
- Fixed a crash bug in the rastertoepson filter.
- Fixed a bug in cgiCheckVariables.
- Fixed handling read/write errors with OpenSSL (Issue #1506)
- Fixed handling rehandshake error in `_httpTLSRead` (Issue #1508)
- Fixed a debug printf bug on Windows (Issue #1529)
- Fixed a recursion issue with encoding of nested collections (Issue #1539)
- Fixed parsing of the `LimitRequestBody`, `MaxLogSize`, and `MaxRequestSize`
  directives in "cupsd.conf" (Issue #1540)
- Fixed a parsing bug in `ipptool` (Issue #1542)
- Fixed blank line detection in the `rastertolabel` filter (Issue #1545)
- Fixed `httpPeek` edge case on compressed streams

Log message:
*: recursive bump for nettle 4.0 shlib major bump

Log message:
*: recursive bump for icu 78.1