Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - OpenPrinting CUPS 之前 2.4.20 包含由工作建立要求中重複的 IPP 群組標籤所引起的 NULL 指標解除參照。IPP 剖析會建立具有 IPP_TAG_ZERO 的未命名分隔符號屬性，但 add_job（） 會將這些分隔符號轉換為 IPP_TAG_JOB。在工作啟動期間，get_options（）/ipp_length（） 隨後會在 NULL 屬性名稱上呼叫 strlen（），終止 cupsd 並中斷所有佇列。當用戶端可以連線排程器並將工作提交至支援已提交文件格式的接受且已啟用的佇列時，單一特製的列印工作要求可能會觸發當機。當接聽程式和存取控制設定允許時，可以匿名提交。（CVE-2026-107890）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 之前 2.4.20 的 OpenPrinting CUPS 包含空指针取消引用，这是由创建作业请求中重复的 IPP 群组标签所造成。IPP 解析创建具有 IPP_TAG_ZERO 的未命名分隔符属性，但 add_job（） 会将这些分隔符转换为IPP_TAG_JOB。在作业启动期间，get_options（）/ipp_length（） 随后会在空属性名称上调用 strlen（），从而终止 cupsd 并中断所有队列。当客户端可联系到计划程序并将作业提交到支持所提交文档格式的接受且已启用的队列时，单个构建的打印作业请求可触发崩溃。监听器和访问控制配置允许时，可能进行匿名提交。（CVE-2026-107890）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 2.4.20 より前の OpenPrinting CUPS には、ジョブ作成リクエストでの IPP グループタグの繰り返しによって引き起こされる NULL ポインターデリファレンスが含まれています。IPP 解析は名前のないセパレーター属性を IPP_TAG_ZERO で作成しますが、add_job() はこれらのセパレーターを IPP_TAG_JOB に変換します。その後、ジョブの起動中に、get_options()/ipp_length() は NULL 属性名で strlen() を呼び出し、cupsd を終了させ、すべてのキューを混乱させます。クライアントがスケジューラに到達し、送信済みのドキュメント形式をサポートする承認済みの有効キューにジョブを送信できた場合に、単一の細工された Print-Job リクエストがクラッシュを発生させる可能性があります。リスナーとアクセスコントロールの設定で許可されている場合、匿名送信が可能です。(CVE-2026-107890)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in     job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job()     converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently     calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted     Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an     accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when     permitted by listener and access-control configuration. (CVE-2026-107890)

Note that Nessus relies on the presence of the package as reported by the vendor.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791915424 advisory.

  - OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout     handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever     any client connection has an in-flight Send-Document operation, without matching that connection to the     job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request     containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete     jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs     is exhausted and further legitimate print submissions are rejected. The suppression ends when the held     connection closes. (CVE-2026-107885)

  - OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-     Class replaces an existing class member list, add_class() frees pclass->printers without clearing the     pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class     subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete     classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
    (CVE-2026-107886)

  - OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked     job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer     cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the     NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all     queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
    (CVE-2026-107888)

  - OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in     job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job()     converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently     calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted     Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an     accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when     permitted by listener and access-control configuration. (CVE-2026-107890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
364395	Linux Distros 未修補弱點：CVE-2026-107890	Nessus	Misc.	2026/10/9	2026/10/12	low
364395	Linux Distros 未修补的漏洞：CVE-2026-107890	Nessus	Misc.	2026/10/9	2026/10/12	low
364395	Linux Distros のパッチ未適用の脆弱性: CVE-2026-107890	Nessus	Misc.	2026/10/9	2026/10/12	low
364395	Linux Distros Unpatched Vulnerability : CVE-2026-107890	Nessus	Misc.	2026/10/9	2026/10/12	low
365356	AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791915424)	Nessus	Alma Linux Local Security Checks	2026/10/13	2026/10/13	medium

偵測

搜尋 Plugin

low

low

low

low

medium