This advisory covers two vulnerabilities in CUPS on Red Hat Enterprise Linux 9. CVE-2025-58364 is a null pointer dereference in the ipp_read_io() function that can cause a remote denial of service. CVE-2025-58060 is an authentication bypass vulnerability in the CUPS authorization mechanism. Both vulnerabilities have been addressed by Red Hat in updated packages. The advisory lists affected product versions and architectures and provides references for applying the updates. No CVSS scores are provided, but the severity is rated as important/high by Red Hat. There are no known exploits in the wild.

Successful exploitation of CVE-2025-58364 can cause a remote denial of service by triggering a null pointer dereference in CUPS. CVE-2025-58060 allows an attacker to bypass authentication in CUPS authorization handling, potentially enabling unauthorized access to printing services. These vulnerabilities could disrupt printing services and compromise access controls on affected systems. No evidence of active exploitation is reported.

Red Hat has released updated CUPS packages that fix these vulnerabilities. Users should apply the security update RHSA-2025:15700 and ensure all prior relevant errata are installed. Detailed update instructions are available from Red Hat's official advisory. Since this is not a cloud service, remediation requires manual patching by system administrators. There are no vendor statements indicating that no action is required or that the issue is already mitigated without patching.