v1.3.9

Changes in CUPS v1.3.9:

• SECURITY: The HP-GL/2 filter did not range check pen numbers (Issue #2911)
• SECURITY: The SGI image file reader did not range check 16-bit run lengths (Issue #2918)
• SECURITY: The text filter did not range check cpi, lpi, or column values (Issue #2919)
• Documentation updates (Issue #2904, Issue #2944)
• The French web admin page was never updated (Issue #2963)
• The IPP backend did not retry print jobs when the printer reported itself as busy or unavailable (Issue #2951)
• The "Set Allowed Users" web interface did not handle trailing whitespace correctly (Issue #2956)
• The PostScript filter did not work with Adobe applications using custom page sizes (Issue #2968)
• The Mac OS X USB backend did not work with some printers that reported a bad 1284 device ID.
• The scheduler incorrectly resolved the client connection address when HostNameLookups was set to Off (Issue #2946)
• The IPP backend incorrectly stopped the local queue if the remote server reported the "paused" state.
• The cupsGetDests() function did not catch all types of request errors.
• The scheduler did not always log "job queued" messages (Issue #2943)
• The scheduler did not support destination filtering using the printer-location attribute properly (Issue #2945)
• The scheduler did not send the server-started, server-restarted, or server-stopped events (Issue #2927)
• The scheduler no longer enforces configuration file permissions on symlinked files (Issue #2937)
• CUPS now reinitializes the DNS resolver on failures (Issue #2920)
• The CUPS desktop menu item was broken (Issue #2924)
• The PPD parser was too strict about missing keyword values in "relaxed" mode.
• The PostScript filter incorrectly mirrored landscape documents.
• The scheduler did not correctly update the auth-info-required value(s) if the AuthType was Default.
• The scheduler required Kerberos authentication for all operations on remote Kerberized printers instead of just for the operations that needed it.
• The socket backend could wait indefinitely for back- channel data with some devices.
• PJL panel messages were not reset correctly on older printers (Issue #2909)
• cupsfilter used the wrong default path (Issue #2908)
• Fixed address matching for "BrowseAddress @if(name)" (Issue #2910)
• Fixed compiles on AIX.
• Firefox 3 did not work with the CUPS web interface in SSL mode (Issue #2892)
• Custom options with multiple parameters were not emitted correctly.
• Refined the cupstestppd utility.
• ppdEmit*() did not support custom JCL options (Issue #2889)
• The cupstestppd utility incorrectly reported missing "en" base translations (Issue #2887)

v1.3.8

Changes in CUPS v1.3.8:

• Documentation updates (Issue #2785, Issue #2861, Issue #2862)
• The scheduler did not add the ending job sheet when the job was released.
• The IPP backend did not relay marker-* attributes.
• The CUPS GNOME/KDE menu item was not localized for Chinese (Issue #2880)
• The CUPS GNOME/KDE menu item was not localized for Japanese (Issue #2876)
• The cupstestppd utility reported mixed line endings for Mac OS and Windows PPD files (Issue #2874)
• The pdftops filter did not print landscape orientation PDF pages correctly on all printers (Issue #2850)
• The scheduler did not handle expiring of implicit classes or their members properly, leading to a configuration where one of the members would have a short name (Issue #2766)
• The scheduler and cupstestppd utilities did not support cupsFilter and cupsPreFilter programs with spaces in their names (Issue #2866)
• Removed unused variables and assignments found by the LLVM "clang" tool.
• Added NULL checks recommended by the LLVM "clang" tool.
• The scheduler would crash if you started a printer that pointed to a backend that did not exist (Issue #2865)
• The ppdLocalize functions incorrectly mapped all generic locales to country-specific locales.
• The cups-driverd program did not support Simplified Chinese or Traditional Chinese language version strings (Issue #2851)
• Added an Indonesian translation (Issue #2792)
• Fixed a timing issue in the backends that could cause data corruption with the CUPS_SC_CMD_DRAIN_OUTPUT side-channel command (Issue #2858)
• The scheduler did not support "HostNameLookups" with all of the boolean names (Issue #2861)
• Fixed a compile problem with glibc 2.8 (Issue #2860)
• The scheduler incorrectly filtered out queues with ACLs and authentication.
• The PostScript filter did not support %%IncludeFeature lines in the page setup section of each page (Issue #2831)
• The scheduler did not generate printer-state events when the default printer was changed (Issue #2764)
• cupstestppd incorrectly reported a warning about the PPD format version in some locales (Issue #2854)
• cupsGetPPD() and friends incorrectly returned a PPD file for a class with no printers.
• The member-uris values for local printers in a class returned by the scheduler did not reflect the connected hostname or port.
• The CUPS PHP extension was not thread-safe (Issue #2828)
• The scheduler incorrectly added the document-format-default attribute to the list of "common" printer attributes, which over time would slow down the printing system (Issue #2755, Issue #2836)
• The cups-deviced and cups-driverd helper programs did not set the CFProcessPath environment variable on Mac OS X (Issue #2837)
• "lpstat -p" could report the wrong job as printing (Issue #2845)
• The scheduler would crash when some cupsd.conf directives were missing values (Issue #2849)
• The web interface "move jobs" operation redirected users to the wrong URL (Issue #2815)
• The Polish web interface translation contained errors (Issue #2815)
• The scheduler did not report PostScript printer PPDs with filters as PostScript devices.
• The scheduler did not set the job document-format attribute for jobs submitted using Create-Job and Send-Document.
• cupsFileTell() did not work for log files opened in append mode (Issue #2810)
• The scheduler did not set QUERY_STRING all of the time for CGI scripts (Issue #2781, Issue #2816)
• The scheduler now returns an error for bad job-sheets values (Issue #2775)
• Authenticated remote printing did not work over domain sockets (Issue #2750)
• The scheduler incorrectly logged errors for print filters when a job was canceled (Issue #2806, #2808)
• The scheduler no longer allows multiple RSS subscriptions with the same URI (Issue #2789)
• The scheduler now supports Kerberized printing with multiple server names (Issue #2783)
• "Satisfy any" did not work in IPP policies (Issue #2782)
• The CUPS imaging library would crash with very large images - more than 16Mx16M pixels (Issue #2805)
• The PNG image loading code would crash with large images (Issue #2790)
• The scheduler did not limit the total number of filters.
• The scheduler now ensures that the RSS directory has the correct permissions.
• The RSS notifier did not quote the feed URL in the RSS file it created (Issue #2801)
• The web interface allowed the creation and cancellation of RSS subscriptions without a username (Issue #2774)
• Increased the default MaxCopies value on Mac OS X to 9999 to match the limit imposed by the print dialog.
• The scheduler did not reject requests with an empty Content-Length field (Issue #2787)
• The scheduler did not log the current date and time and did not escape special characters in request URIs when logging bad requests to the access_log file (Issue #2788)

v1.3.7

Changes in CUPS v1.3.7:

• CVE-2008-0047: cgiCompileSearch buffer overflow (Issue #2729)
• CVE-2008-1373: CUPS GIF image filter overflow (Issue #2765)
• Updated the "make check" tests to do a more thorough automated test.
• cups-driverd complained about missing directories (Issue #2777)
• cupsaddsmb would leave the Samba username and password on disk if no Windows drivers were installed (Issue #2779)
• The Linux USB backend used 100% CPU when a printer was disconnected (Issue #2769)
• The sample raster drivers did not properly handle SIGTERM (Issue #2770)
• The scheduler sent notify_post() messages too often on Mac OS X.
• Kerberos access to the web interface did not work (Issue #2748)
• The scheduler did not support "AuthType Default" in IPP policies (Issue #2749)
• The scheduler did not support the "HideImplicitMembers" directive as documented (Issue #2760)
• "make check" didn't return a non-zero exit code on error (Issue #2758)
• The scheduler incorrectly logged AUTH_foo environment variables in debug mode (Issue #2751)
• The image filters inverted PBM files (Issue #2746)
• cupsctl would crash if the scheduler was not running (Issue #2741)
• The scheduler could crash when printing using a port monitor (Issue #2742)
• The scheduler would crash if PAM was broken (Issue #2734)
• The image filters did not work with some CMYK JPEG files produced by Adobe applications (Issue #2727)
• The Mac OS X USB backend did not work with printers that did not report a make or model.
• The job-sheets option was not encoded properly (Issue #2715)
• The scheduler incorrectly complained about missing LSB PPD directories.

v1.3.6

Changes in CUPS v1.3.6:

• Documentation updates (Issue #2646, Issue #2647, Issue #2649)
• Fixed a problem with the web interface "Use Kerberos Authentication" check box (Issue #2703)
• The scheduler unconditionally overwrote the printer-state- message with "process-name failed" when a filter or backend failed, preventing a useful error message from being shown to the user.
• Policies on CUPS-Move-Job didn't work as expected (Issue #2699)
• The configure script only supported D-BUS on Linux (Issue #2702)
• The scheduler did not support (Issue #2701)
• The scheduler did not reset the job-hold-until attribute after a job's hold time was reached.
• The scheduler did not support printer supply attributes (Issue #1307)
• The Kerberos credentials provided by some Windows KDCs were still too large - now use a dynamic buffer to support credentials up to 64k in size (Issue #2695)
• Printing a test page from the web interface incorrectly defaulted to the "guest" user (Issue #2688)
• The cupsEncodeOptions2() function did not parse multiple- value attribute values properly (Issue #2690)
• The scheduler incorrectly sent printer-stopped events for status updates from the print filters (Issue #2680)
• The IPP backend could crash when handling printer errors (Issue #2667)
• Multi-file jobs did not print to remote CUPS servers (Issue #2673)
• The scheduler did not provide the Apple language ID to job filters.
• Kerberos authentication did not work with the web interface (Issue #2606, Issue #2669)
• The requesing-user-name-allowed and -denied functionality did not work for Kerberos-authenticated usernames (Issue #2670)
• CUPS didn't compile on HP-UX 11i (Issue #2679)
• cupsEncodeOptions2() did not handle option values like "What's up, doc?" properly.
• Added lots of memory allocation checks (Fortify)
• The scheduler would crash if it was unable to add a job file (Fortify)
• ppdOpen*() did not check all memory allocations (Coverity)
• ippReadIO() did not check all memory allocations (Coverity)
• The PostScript filter did not detect read errors (Coverity)
• The scheduler did not check for a missing job-sheets-completed attribute when sending an event notification (Coverity)
• "Set Printer Options" might not work with raw queues (Coverity)
• cupsRasterInterpretPPD() could crash on certain PostScript errors (Coverity)
• The USB backend did not check for back-channel support properly on all systems (Coverity)
• Fixed memory leaks in the GIF and PNM image loading code (Coverity)
• Removed some dead code in the CUPS API and scheduler (Coverity)
• Fixed two overflow bugs in the HP-GL/2 filter (Coverity)
• Fixed another ASN1 string parsing bug (Issue #2665)
• The RSS notifier directory was not installed with the correct permissions.
• The standard CUPS backends could use 100% CPU while waiting for print data (Issue #2664)
• Filename-based MIME rules did not work (Issue #2659)
• The cups-polld program did not exit if the scheduler crashed (Issue #2640)
• The scheduler would crash if you tried to set the port-monitor on a raw queue (Issue #2639)
• The scheduler could crash if a polled remote printer was converted to a class (Issue #2656)
• The web interface and cupsctl did not correctly reflect the "allow printing from the Internet" state (Issue #2650)
• The scheduler incorrectly treated MIME types as case- sensitive (Issue #2657)
• The Java support classes did not send UTF-8 strings to the scheduler (Issue #2651)
• The CGI code did not handle interrupted POST requests properly (Issue #2652)
• The PostScript filter incorrectly handled number-up when the number of pages was evenly divisible by the number-up value.
• The PDF filter incorrectly filtered pages when page-ranges and number-up were both specified (Issue #2643)
• The IPP backend did not handle printing of pictwps files to a non-Mac CUPS server properly.
• The scheduler did not detect network interface changes on operating systems other than Mac OS X (Issue #2631)
• The scheduler now logs the UNIX error message when it is unable to create a request file such as a print job.
• Added support for --enable-pie on Mac OS X.

v1.3.5

Changes in CUPS v1.3.5:

• The SNMP backend did not check for negative string lengths (Issue #2589)
• The scheduler incorrectly removed auth-info attributes, potentially leading to a loss of all options for a job.
• The scheduler stopped sending CUPS browse packets on a restart when using fixed addresses (Issue #2618)
• Fixed PDF filter security issues (CVE-2007-4352 CVE-2007-5392 CVE-2007-5393)
• Changing settings would always change the DefaultAuthType and Allow lines (Issue #2580)
• The scheduler would crash when submitting an undefined format file from Samba with LogLevel debug2 (Issue #2600)
• The scheduler did not use poll() when epoll() was not supported by the running kernel (Issue #2582)
• Fixed a compile problem with Heimdal Kerberos (Issue #2592)
• The USB backend now retries connections to a printer indefinitely rather than stopping the queue.
• Printers with untranslated JCL options were not exported to Samba correctly (Issue #2570)
• The USB backend did not work with some Minolta USB printers (Issue #2604)
• The strcasecmp() emulation code did not compile (Issue #2612)
• The scheduler would crash if a job was sent to an empty class (Issue #2605)
• The lpc command did not work in non-UTF-8 locales (Issue #2595)
• Subscriptions for printer-stopped events also received other state changes (Issue #2572)
• cupstestppd incorrectly reported translation errors for the "en" locale.
• ppdOpen() did not handle custom options properly when the Custom attribute appeared before the OpenUI for that option.
• The scheduler could crash when deleting a printer or listing old jobs.
• The Mac OS X USB backend did not allow for requeuing of jobs submitted to a class.
• lpmove didn't accept a job ID by itself.
• The scheduler incorrectly removed job history information for remote print jobs.
• The scheduler incorrectly sent the "com.apple.printerListChanged" message for printer state changes.
• The PostScript filter drew the page borders (when enabled) outside the imageable area.
• The LPD and IPP backends did not default to the correct port numbers when using alternate scheme names.
• The scheduler incorrectly deleted hardwired remote printers on system sleep.
• The scheduler would abort if a bad browse protocol name was listed in the cupsd.conf file.
• The online cupsd.conf help file incorrectly showed "dns-sd" instead of "dnssd" for Bonjour sharing.
• The scheduler could crash changing the port-monitor value.
• The scheduler generated CoreFoundation errors when run as a background process.
• When printing with number-up > 1, it was possible to get an extra blank page.

v1.3.4

Changes in CUPS v1.3.4:

• Documentation updates (Issue #2560, Issue #2563, Issue #2569)
• CUPS now maps the "nb" locale to "no" on all platforms (Issue #2575)
• CUPS did not work with a Windows 2003 R2 KDC (Issue #2568)
• ippReadIO() could read past the end of a buffer (Issue #2561)
• The scheduler would crash on shutdown if it was unable to create a Kerberos context.
• Multiple AuthTypes in cupsd.conf did not work (Issue #2545)
• The snmp.conf file referenced the wrong man page (Issue #2564)
• The cupsaddsmb program didn't handle domain sockets properly (Issue #2556)
• The scheduler now validates device URIs when adding printers.
• Updated httpSeparateURI() to support hostnames with the backslash character.
• Updated the Japanese localization (Issue #2546)
• The parallel backend now gets the current IEEE-1284 device ID string on Linux (Issue #2553)
• The IPP backend now checks the job status at variable intervals (from 1 to 10 seconds) instead of every 10 seconds for faster remote printing (Issue #2548)
• "lpr -p" and "lpr -l" did not work (Issue #2544)
• Compilation failed when a previous version of CUPS was installed and was included in the SSL include path (Issue #2538)
• The scheduler did not reject requests with charsets other than US-ASCII or UTF-8, and the CUPS API incorrectly passed the locale charset to the scheduler instead of UTF-8 (Issue #2537)
• cups-deviced did not filter out duplicate devices.
• The AppleTalk backend incorrectly added a scheme listing when AppleTalk was disabled or no printers were found.
• The PostScript filter generated N^2 copies when the printer supported collated copies and user requested reverse-order output.
• The scheduler did not reprint all of the files in a job that was held.
• The scheduler did not update the printcap file after removing stale remote queues.
• The cupsd.conf man page incorrectly referenced "AuthType Kerberos" instead of "AuthType Negotiate".

v1.3.3

Changes in CUPS v1.3.3:

• The scheduler did not use the attributes-natural-language attribute when passing the LANG environment variable to cups-deviced or cups-driverd.
• The scheduler did not use the printer-op-policy when modifying classes or printers (Issue #2525)
• The auth-info-required attribute was not always updated for remote queues that required authentication.
• The German web interface localization contained errors (Issue #2523)
• The Swedish localization contained errors (Issue #2522)

v1.3.2

Changes in CUPS v1.3.2:

• The 1.3.1 release was incorrectly created from the 1.4.x source tree (Issue #2519)
• Added support for 32/64-bit libraries on HP-UX (Issue #2520)
• The scheduler incorrectly used portrait as the default orientation (Issue #2513)
• The scheduler no longer writes the printcap file for every remote printer update (Issue #2512)
• Remote raw printing with multiple copies did not work (Issue #2518)
• Updated the configure script to require at least autoconf 2.60 (Issue #2515)
• Some gzip'd PPD files were not read in their entirety (Issue #2510)

v1.3.11

Changes in CUPS v1.3.11:

• The scheduler did not prevent nested classes (Issue #3211)
• The scheduler did not reprint processing jobs that were moved to another destination (Issue #3222)
• The scheduler did not reset the current job file when stopping a printer (Issue #3226)
• The scheduler did not handle POSTs to custom CGIs properly (Issue #3221)
• The pdftops filter did not print landscape PDF pages properly (Issue #2881)
• The scheduler did not handle partial header lines properly from CGI programs (Issue #3194)
• The web interface could hang on OpenBSD (Issue #3176, Issue #3196)
• The scheduler and cupsfilter utility did not handle rules starting with a negation operator properly (Issue #3160)
• The scheduler and cupsfilter utility would crash with certain MIME .types rules (Issue #3159)
• httpSetField wasn't bracketing IPv6 numeric addresses for the Host: field (Issue #3164)
• The ServerName, if specified, was not treated as a valid alias for the local system (Issue #3167)
• "make epm" did not work (Issue #3166)
• "lpstat -h server" showed non-shared printers (Issue #3147)
• "make check" did not work on Linux (Issue #3161)

v1.3.10

Changes in CUPS v1.3.10:

• Documentation fixes (Issue #2994, Issue #2995, Issue #3008, Issue #3056, Issue #3057)
• SECURITY: The scheduler now protects against DNS rebinding attacks (Issue #3118)
• SECURITY: Fixed TIFF integer overflow in image filters (Issue #3031)
• The scheduler did not support the job-hold-until attribute with the Restart-Job operation (Issue #3130)
• SECURITY: The PNG image reading code did not validate the image size properly, leading to a potential buffer overflow (Issue #2974)
• The rastertohp driver did not set the 1-sided printing mode when needed (Issue #3131)
• Now use a wrapper program instead of our fork of the Xpdf code to support printing of PDF files. The new wrapper supports using Xpdf, poppler, or Ghostscript to convert PDF files to PostScript (Issue #3129)
• Long job names caused problems with some PJL printers (Issue #3125)
• The lpq command did not work when showing all destinations (Issue #3117)
• The scheduler used a codeset name of UTF8 which is not supported on Solaris (Issue #3113)
• cupsGetJobs() did not work with a NULL destination (Issue #3107)
• Fixed a localization problem for option choices (incorrectly) named "Custom" (Issue #3106)
• The fallback OpenSSL random number seeding would not work (Issue #3079)
• The scheduler might miss a child signal, causing high CPU usage.
• The scheduler did not enforce quotas after the job history was unloaded (Issue #3078)
• The job-k-limit, job-page-limit, and job-quota-period attributes could not be set using the lpadmin command (Issue #3077)
• httpSeparateURI() did not error out on URIs with a missing port number after a colon.
• Fixed a Valgrind-detected initialization error when creating a missing directory on startup.
• The scheduler did not always read all of the HTTP headers from a CGI script/program.
• The scheduler did not always set the "air" property in Bonjour/DNS-SD registrations.
• The scheduler incorrectly compared Mac OS X UUIDs for access control, preventing access in certain configurations.
• The IPP backend incorrectly reset the required authentication to Kerberos when authentication failed.
• The scheduler no longer looks up the local hostname by default; turn on hostname lookups to restore the previous behavior.
• The scheduler did not always load MIME type rules correctly (Issue #3059)
• The test page did not format correctly on A4 paper (Issue #3060)
• The web interface sometimes incorrectly redirected users to 127.0.0.1 (Issue #3022)
• cupsPrintFile*() did not send the document filename for single file submissions (Issue #3055)
• The scheduler did not update the member-names attribute when removing the last printer from a class.
• The scheduler did not report PPD Products with parenthesis in them properly (Issue #3046)
• The wrong italic fonts were listed in the UTF-8 charset file for the text filter.
• The backends did not return an OK status for the CUPS_SC_CMD_GET_BIDI side-channel command (Issue #3029)
• The scheduler did not purge jobs that were missing a time-at-creation attribute, indicating a bad job control file (Issue #3030)
• The "-o job-hold-until=week-end" option did not work properly (Issue #3025)
• The Solaris USB printer device does not support select or poll (Issue #3028)
• The scheduler would crash if you exceeded the MaxSubscriptions limit.
• The lp "-H immediate" option did not specify that the job should not be held (Issue #3013)
• The scheduler did not support the "Connection: close" HTTP header (Issue #3010)
• The mailto notifier didn't terminate messages properly (Issue #3011)
• Backends could spin trying to read back-channel data (Issue #3001)
• The HP-GL/2 filter was using the wrong default colors (Issue #2966)
• The scheduler incorrectly allowed Get-Jobs operations without a printer-uri (Issue #2996)
• The compression option was not being encoded properly (Issue #2997)
• Added a missing character map for JIS-X0213/ShiftJIS.
• The scheduler now rejects ATTR: messages with empty values.
• The scheduler could consume all CPU handling closed connections (Issue #2988)
• Fixed some configure script bugs with rc/xinetd directories (Issue #2970)
• The Epson sample driver PPDs contained errors (Issue #2979)