fix(cve): CVE-2026-55480 - Open temporary PPD files more securely.

debian/changelog

@@ -1,3 +1,65 @@
+cups (2.4.16-1deepin21) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-55480 (medium) - Open temporary PPD files more
+    securely.   Upstream:
+    https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d
+    5438ad32e26aac62
+  * fix(cve): CVE-2026-61702 (medium) - Validate attributes-natural-
+    language, and normalize the logging punctuation   Upstream:
+    https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af3355
+    2247a1ac53b72df3
+  * fix(cve): CVE-2026-107888 (medium) - Abort held jobs if the
+    destination has gone away (GHSA-qqm8-4q5h-jg55)   Upstream:
+    https://github.com/OpenPrinting/cups/commit/c5fc041ca0a211f8e6985490
+    7be7b55f56955659
+  * fix(cve): CVE-2026-107886 (low) - Initialize printers array to NULL
+    after freeing (GHSA-pwg4-pv39-8c22)   Upstream:
+    https://github.com/OpenPrinting/cups/commit/13bc9d4f8d695403d54469cc
+    3c8b675e34a7037f
+  * fix(cve): CVE-2026-55467 (low) - Sanitizer destination-uri and pre-
+    dial-string values.   Upstream:
+    https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222
+    bce3aa342d541681
+  * fix(cve): CVE-2026-87876 (low) - Consistently compare usernames for
+    policies and quotas.   Upstream:
+    https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36
+    686f7a0b2982fef8.patch
+  * fix(cve): CVE-2026-107890 (low) - Filter out group separators in job
+    creation requests (GHSA-wjc4-qhjr-5m5x)   Upstream:
+    https://github.com/OpenPrinting/cups/commit/f3fb41912e4e29dbbbe7c4af
+    d4fe48508af21bc0
+  * fix(cve): CVE-2026-107885 (low) - Don't allow clients to hold a job
+    open longer than the multiple-operation-time-out value (GHSA-hhw5-
+    qqmc-p6rg)   Upstream:
+    https://github.com/OpenPrinting/cups/commit/6c61d23f5523055ec4374465
+    e85d1dec9396994f
+  * fix(cve): CVE-2026-55453 (low) - Sanitize IPP attribute strings.
+    Upstream:
+    https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54
+    118c4c8a36ed596a
+
+  * fix(cve): CVE-2026-87875 (medium) - Fix UTF-32 data type on 64-bit
+    systems.   Upstream:
+    https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b85514
+    2e384f4e8c42d8e4
+  * fix(cve): CVE-2026-107655 (medium) - Add JobTicketComments
+    directive, fix job ticket comment support, and disable by default
+    (GHSA-58wv-9ffm-5w78)   Upstream:
+    https://github.com/OpenPrinting/cups/commit/25d68309b1af89c4b003f27f
+    56ab0f8e7a189ea3
+  * fix(cve): CVE-2026-105326 (low) - Validate notification email
+    addresses and fix sendmail usage (GHSA-r4wf-366f-f6g3)   Upstream:
+    https://github.com/OpenPrinting/cups/commit/611d1bd3bdf8323638323835
+    67906a6d7fd6c47d
+  * fix(cve): CVE-2026-105326 - Fix regression in mailto address
+    validation (Issue #1744): addresses containing a period, such as
+    "user@example.com", were rejected so no notification was sent.
+    Upstream:
+    https://github.com/OpenPrinting/cups/commit/4c5a15599ccbbc2d3b69b06
+    190a44b85321c3211
+
+ -- deepin-ci-robot <packages@deepin.org>  Wed, 21 Oct 2026 02:00:51 +0800
+
 cups (2.4.16-1deepin20) unstable; urgency=medium
 
   * Rebuild with LTO enabled (dpkg vendor feature optimize/lto).

debian/patches/CVE-2026-105326-fix-mailto-validation.patch

@@ -0,0 +1,35 @@
+Description: Fix mailto address validation regression (Issue #1744)
+ The address validation loop added for CVE-2026-105326 (GHSA-r4wf-366f-f6g3)
+ rejects every address containing a period: the "consecutive periods" test
+ is an "else if" that falls through to the allowed-character test, where '.'
+ is not listed. Valid recipients such as "user@example.com" therefore fail
+ validation and the mailto notifier sends no notification at all.
+ Handle "." in its own branch and reject only leading, consecutive and
+ post-'@' periods.
+Author: Michael R Sweet <msweet@msweet.org>
+Origin: https://github.com/OpenPrinting/cups/commit/4c5a15599ccbbc2d3b69b06190a44b85321c3211
+Bug: https://github.com/OpenPrinting/cups/issues/1744
+Last-Update: 2026-10-06
+---
+
+diff --git a/notifier/mailto.c b/notifier/mailto.c
+index 2f118a67..fe0aa58f 100644
+--- a/notifier/mailto.c
++++ b/notifier/mailto.c
+@@ -262,13 +262,14 @@ copy_validate_address(
+
+       saw_at = 1;
+     }
+-    else if (*bufptr == '.' && (bufptr == buffer || bufptr[-1] == '.' || bufptr[-1] == '@'))
++    else if (*bufptr == '.')
+     {
+      /*
+       * dot-atom-text doesn't allow consecutive periods...
+       */
+
+-      goto bad_address;
++      if (bufptr == buffer || bufptr[-1] == '.' || bufptr[-1] == '@')
++	goto bad_address;
+     }
+     else if (!strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+                      "0123456789!#$%&\'*+-/=?^_`{|}~", *bufptr))