public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/hplip] f43: 3.26.6, fixes CVE-2026-91105,CVE-2026-91103,CVE-2026-91102,CVE-2026-91101,
@ 2026-09-23 13:15 Zdenek Dohnal
0 siblings, 0 replies; only message in thread
From: Zdenek Dohnal @ 2026-09-23 13:15 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/hplip
Branch : f43
Commit : 71816b4b9486a61185a6d7689adc2f32e9f9553a
Author : Zdenek Dohnal <zdohnal@redhat.com>
Date : 2026-09-23T14:35:47+02:00
Stats : +197/-340 in 17 file(s)
URL : https://src.fedoraproject.org/rpms/hplip/c/71816b4b9486a61185a6d7689adc2f32e9f9553a?branch=f43
Log:
3.26.6, fixes CVE-2026-91105,CVE-2026-91103,CVE-2026-91102,CVE-2026-91101,
CVE-2026-91100,CVE-2026-91099,CVE-2026-91098,CVE-2026-91097
---
diff --git a/.gitignore b/.gitignore
index 833e1ab..18880be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -117,3 +117,4 @@ hplip-3.10.6.tar.gz
/hplip-3.25.6-repack.tar.gz
/hplip-3.25.8-repack.tar.gz
/hplip-3.26.4-repack.tar.gz
+/hplip-3.26.6-repack.tar.gz
diff --git a/0025-Remove-all-ImageProcessor-functionality-which-is-clo.patch b/0025-Remove-all-ImageProcessor-functionality-which-is-clo.patch
index 7c61d77..fcc21c4 100644
--- a/0025-Remove-all-ImageProcessor-functionality-which-is-clo.patch
+++ b/0025-Remove-all-ImageProcessor-functionality-which-is-clo.patch
@@ -1,8 +1,7 @@
-diff --git a/Makefile.am b/Makefile.am
-index f65afea..12317dc 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -167,7 +167,7 @@ if !HPLIP_CLASS_DRIVER
+diff -up hplip-3.26.6/Makefile.am.libimageprocessor-removal hplip-3.26.6/Makefile.am
+--- hplip-3.26.6/Makefile.am.libimageprocessor-removal 2026-09-22 15:42:23.464291225 +0200
++++ hplip-3.26.6/Makefile.am 2026-09-22 15:43:52.395669915 +0200
+@@ -179,7 +179,7 @@ if !HPLIP_CLASS_DRIVER
dist_hplip_SCRIPTS = hpssd.py __init__.py hpdio.py
endif #HPLIP_CLASS_DRIVER
@@ -11,16 +10,16 @@ index f65afea..12317dc 100644
dist_noinst_DATA += prnt/ipp-usb/HPLIP.conf
dist_noinst_SCRIPTS += dat2drv.py install.py hplip-install init-suse-firewall init-iptables-firewall class_rpm_build.sh hplipclassdriver.spec createPPD.sh Makefile_dat2drv hpijs-drv
-@@ -597,7 +597,7 @@ hpcups_SOURCES = prnt/hpcups/HPCupsFilter.cpp prnt/hpcups/HPCupsFilter.h prnt/hp
- prnt/hpcups/ImageProcessor.h
-
- hpcups_CXXFLAGS = $(APDK_ENDIAN_FLAG) $(DBUS_CFLAGS)
+@@ -605,7 +605,7 @@ hpcups_SOURCES = prnt/hpcups/HPCupsFilte
+ hpcups_CPPFLAGS = -I$(srcdir)/prnt/hpcups -I$(srcdir)/prnt -I$(srcdir)/common -D_GNU_SOURCE
+ hpcups_CXXFLAGS = $(APDK_ENDIAN_FLAG) $(DBUS_CFLAGS) $(AM_CXXFLAGS)
+ hpcups_LDFLAGS = $(AM_LDFLAGS)
-hpcups_LDADD = -L./prnt/hpcups/ -ljpeg -ldl -lImageProcessor -lcups -lcupsimage -lz $(DBUS_LIBS)
+hpcups_LDADD = -L./prnt/hpcups/ -ljpeg -ldl -lcups -lcupsimage -lz $(DBUS_LIBS)
#else
#hpcupsdir = $(cupsfilterdir)
#hpcups_PROGRAMS = hpcups
-@@ -687,16 +687,6 @@ endif #HPLIP_CLASS_DRIVER
+@@ -707,16 +707,6 @@ endif #HPLIP_CLASS_DRIVER
install-data-hook:
if HPLIP_BUILD
diff --git a/hp-plugin.in b/hp-plugin.in
index 8a6155e..e0765b4 100644
--- a/hp-plugin.in
+++ b/hp-plugin.in
@@ -16,7 +16,7 @@ download()
{
SOURCE="$1"
- @bindir@/curl -f --user-agent 'Mozilla/5.0 (compatible; hplip-plugin/1.0)' --create-dirs -O --output-dir ~/.hplip --location ${SOURCE}
+ @bindir@/curl -f --user-agent 'Mozilla/5.0 (compatible; hplip-plugin/1.0)' --create-dirs -O --output-dir ~/.hplip --location "${SOURCE}"
}
# link to the plugin
diff --git a/hplip-CVE-2026-8631-osh.patch b/hplip-CVE-2026-8631-osh.patch
deleted file mode 100644
index 226a570..0000000
--- a/hplip-CVE-2026-8631-osh.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-diff -up hplip-3.21.2/prnt/hpcups/genPCLm.cpp.CVE-2026-8631-osh hplip-3.21.2/prnt/hpcups/genPCLm.cpp
---- hplip-3.21.2/prnt/hpcups/genPCLm.cpp.CVE-2026-8631-osh 2026-07-03 08:25:17.717888763 +0200
-+++ hplip-3.21.2/prnt/hpcups/genPCLm.cpp 2026-07-03 08:48:22.225130940 +0200
-@@ -1922,7 +1922,10 @@ int PCLmGenerator::Encapsulate(void *pI
- int whiteStripLen=0;
- if(!safe_mul_int_positive(thisHeight, currSourceWidth, &whiteStripLen) ||
- !safe_mul_int_positive(whiteStripLen, srcNumComponents, &whiteStripLen))
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
- bool whiteStrip=isWhiteStrip(pInBuffer, whiteStripLen);
- if(DebugIt2)
- {
-@@ -1944,11 +1947,17 @@ int PCLmGenerator::Encapsulate(void *pI
- ubyte whitePt=0xff;
- size_t tmpStripSize=0;
- if(!safe_mul_size_t((size_t)scanlineWidth, (size_t)topMarginInPix, &tmpStripSize))
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
-
- ubyte *tmpStrip=(ubyte*)malloc(tmpStripSize);
- if(!tmpStrip)
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
- memset(tmpStrip,whitePt,tmpStripSize);
-
-
-@@ -2016,7 +2025,10 @@ int PCLmGenerator::Encapsulate(void *pI
- {
- int sourceLen=0;
- if(!safe_mul_int_positive(numLinesThisCall, scanlineWidth, &sourceLen))
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
- uint32 len=(uint32)sourceLen;
- uLongf destSize=len;
-
-@@ -2025,12 +2037,18 @@ int PCLmGenerator::Encapsulate(void *pI
- ubyte whitePt=0xff;
- size_t tmpStripSize=0;
- if(!safe_mul_size_t((size_t)scanlineWidth, (size_t)topMarginInPix, &tmpStripSize))
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
-
- // We need to inject a blank image-strip with a height==topMarginInPix
- ubyte *tmpStrip=(ubyte*)malloc(tmpStripSize);
- if(!tmpStrip)
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
- uLongf tmpDestSize=destSize;
- memset(tmpStrip,whitePt,tmpStripSize);
-
-@@ -2079,20 +2097,29 @@ int PCLmGenerator::Encapsulate(void *pI
- {
- int sourceLen=0;
- if(!safe_mul_int_positive(numLinesThisCall, scanlineWidth, &sourceLen))
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
-
- if(firstStrip && topMarginInPix)
- {
- ubyte whitePt=0xff;
- size_t tmpStripSize=0;
- if(!safe_mul_size_t((size_t)scanlineWidth, (size_t)topMarginInPix, &tmpStripSize))
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
-
- // We need to inject a blank image-strip with a height==topMarginInPix
-
- ubyte *tmpStrip=(ubyte*)malloc(tmpStripSize);
- if(!tmpStrip)
-+ {
-+ free(newStripPtr);
- return(errorOutAndCleanUp());
-+ }
- memset(tmpStrip,whitePt,tmpStripSize);
-
- for(sint32 stripCntr=0; stripCntr<numFullInjectedStrips;stripCntr++)
diff --git a/hplip-add-ppd-crash.patch b/hplip-add-ppd-crash.patch
index beb070d..d8ab59d 100644
--- a/hplip-add-ppd-crash.patch
+++ b/hplip-add-ppd-crash.patch
@@ -1,7 +1,7 @@
-diff -up hplip-3.23.3/ui5/setupdialog.py.add-ppd-crash hplip-3.23.3/ui5/setupdialog.py
---- hplip-3.23.3/ui5/setupdialog.py.add-ppd-crash 2023-05-29 13:55:03.443497903 +0200
-+++ hplip-3.23.3/ui5/setupdialog.py 2023-05-29 13:57:19.014700721 +0200
-@@ -765,10 +765,9 @@ class SetupDialog(QDialog, Ui_Dialog):
+diff -up hplip-3.26.6/ui5/setupdialog.py.add-ppd-crash hplip-3.26.6/ui5/setupdialog.py
+--- hplip-3.26.6/ui5/setupdialog.py.add-ppd-crash 2026-09-22 15:44:33.786000592 +0200
++++ hplip-3.26.6/ui5/setupdialog.py 2026-09-22 15:47:18.858699815 +0200
+@@ -767,10 +767,9 @@ class SetupDialog(QDialog, Ui_Dialog):
pass
def OtherPPDButton_clicked(self, b):
@@ -13,5 +13,5 @@ diff -up hplip-3.23.3/ui5/setupdialog.py.add-ppd-crash hplip-3.23.3/ui5/setupdia
+ sys_conf.get('dirs', 'ppd'),
+ self.__tr("PPD Files (*.ppd *.ppd.gz);;All Files (*)"))[0]
- if ppd_file and os.path.exists(ppd_file):
- self.print_ppd = (ppd_file, cups.getPPDDescription(ppd_file))
+ if ppd_file:
+ is_valid, validation_err = utils.validate_alternative_ppd(ppd_file, sys_conf.get('dirs', 'ppd'))
diff --git a/hplip-covscan.patch b/hplip-covscan.patch
index 29384dc..39dc4c8 100644
--- a/hplip-covscan.patch
+++ b/hplip-covscan.patch
@@ -1,6 +1,6 @@
-diff -up hplip-3.25.2/common/utils.c.covscan hplip-3.25.2/common/utils.c
---- hplip-3.25.2/common/utils.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/common/utils.c 2025-04-11 10:21:58.034950818 +0200
+diff -up hplip-3.26.6/common/utils.c.covscan hplip-3.26.6/common/utils.c
+--- hplip-3.26.6/common/utils.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/common/utils.c 2026-09-22 16:03:14.766837329 +0200
@@ -1,5 +1,9 @@
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
@@ -12,10 +12,10 @@ diff -up hplip-3.25.2/common/utils.c.covscan hplip-3.25.2/common/utils.c
#include <dlfcn.h>
#include <sys/stat.h>
#include <errno.h>
-diff -up hplip-3.25.2/io/hpmud/hpmud.c.covscan hplip-3.25.2/io/hpmud/hpmud.c
---- hplip-3.25.2/io/hpmud/hpmud.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/io/hpmud/hpmud.c 2025-04-11 10:21:58.035151792 +0200
-@@ -769,6 +769,7 @@ enum HPMUD_RESULT hpmud_get_dstat(HPMUD_
+diff -up hplip-3.26.6/io/hpmud/hpmud.c.covscan hplip-3.26.6/io/hpmud/hpmud.c
+--- hplip-3.26.6/io/hpmud/hpmud.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/io/hpmud/hpmud.c 2026-09-22 16:03:14.767096575 +0200
+@@ -770,6 +770,7 @@ enum HPMUD_RESULT hpmud_get_dstat(HPMUD_
}
strncpy(ds->uri, msp->device[dd].uri, sizeof(ds->uri));
@@ -23,9 +23,9 @@ diff -up hplip-3.25.2/io/hpmud/hpmud.c.covscan hplip-3.25.2/io/hpmud/hpmud.c
ds->io_mode = msp->device[dd].io_mode;
ds->channel_cnt = msp->device[dd].channel_cnt;
ds->mlc_up = msp->device[dd].mlc_up;
-diff -up hplip-3.25.2/io/hpmud/jd.c.covscan hplip-3.25.2/io/hpmud/jd.c
---- hplip-3.25.2/io/hpmud/jd.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/io/hpmud/jd.c 2025-04-11 10:21:58.035328288 +0200
+diff -up hplip-3.26.6/io/hpmud/jd.c.covscan hplip-3.26.6/io/hpmud/jd.c
+--- hplip-3.26.6/io/hpmud/jd.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/io/hpmud/jd.c 2026-09-22 16:03:14.767318561 +0200
@@ -31,6 +31,7 @@
#endif
@@ -34,9 +34,9 @@ diff -up hplip-3.25.2/io/hpmud/jd.c.covscan hplip-3.25.2/io/hpmud/jd.c
#include "hpmud.h"
#include "hpmudi.h"
-diff -up hplip-3.25.2/io/hpmud/model.c.covscan hplip-3.25.2/io/hpmud/model.c
---- hplip-3.25.2/io/hpmud/model.c.covscan 2025-04-11 10:21:58.023885145 +0200
-+++ hplip-3.25.2/io/hpmud/model.c 2025-04-11 10:21:58.035487541 +0200
+diff -up hplip-3.26.6/io/hpmud/model.c.covscan hplip-3.26.6/io/hpmud/model.c
+--- hplip-3.26.6/io/hpmud/model.c.covscan 2026-09-22 16:03:14.757633422 +0200
++++ hplip-3.26.6/io/hpmud/model.c 2026-09-22 16:03:14.767539204 +0200
@@ -117,6 +117,7 @@ static int ReadConfig()
if (rcbuf[0] == '[')
{
@@ -53,9 +53,9 @@ diff -up hplip-3.25.2/io/hpmud/model.c.covscan hplip-3.25.2/io/hpmud/model.c
break; /* done */
}
}
-diff -up hplip-3.25.2/io/hpmud/musb.c.covscan hplip-3.25.2/io/hpmud/musb.c
---- hplip-3.25.2/io/hpmud/musb.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/io/hpmud/musb.c 2025-04-11 10:21:58.035717762 +0200
+diff -up hplip-3.26.6/io/hpmud/musb.c.covscan hplip-3.26.6/io/hpmud/musb.c
+--- hplip-3.26.6/io/hpmud/musb.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/io/hpmud/musb.c 2026-09-22 16:03:14.767793100 +0200
@@ -776,7 +776,7 @@ static int device_id(int fd, unsigned ch
len = size-1; /* leave byte for zero termination */
if (len > 2)
@@ -65,9 +65,9 @@ diff -up hplip-3.25.2/io/hpmud/musb.c.covscan hplip-3.25.2/io/hpmud/musb.c
buffer[len]=0;
DBG("read actual device_id successfully fd=%d len=%d\n", fd, len);
-diff -up hplip-3.25.2/io/hpmud/pp.c.covscan hplip-3.25.2/io/hpmud/pp.c
---- hplip-3.25.2/io/hpmud/pp.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/io/hpmud/pp.c 2025-04-11 10:21:58.035977040 +0200
+diff -up hplip-3.26.6/io/hpmud/pp.c.covscan hplip-3.26.6/io/hpmud/pp.c
+--- hplip-3.26.6/io/hpmud/pp.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/io/hpmud/pp.c 2026-09-22 16:03:14.768123989 +0200
@@ -632,7 +632,7 @@ static int device_id(int fd, char *buffe
len = size-1; /* leave byte for zero termination */
if (len > 2)
@@ -77,9 +77,9 @@ diff -up hplip-3.25.2/io/hpmud/pp.c.covscan hplip-3.25.2/io/hpmud/pp.c
buffer[len]=0;
DBG("read actual device_id successfully fd=%d len=%d\n", fd, len);
-diff -up hplip-3.25.2/Makefile.am.covscan hplip-3.25.2/Makefile.am
---- hplip-3.25.2/Makefile.am.covscan 2025-04-11 10:21:58.010155532 +0200
-+++ hplip-3.25.2/Makefile.am 2025-04-11 10:22:52.826357214 +0200
+diff -up hplip-3.26.6/Makefile.am.covscan hplip-3.26.6/Makefile.am
+--- hplip-3.26.6/Makefile.am.covscan 2026-09-22 16:03:14.748480370 +0200
++++ hplip-3.26.6/Makefile.am 2026-09-22 16:03:14.768434230 +0200
@@ -3,7 +3,7 @@
#
# (c) 2004-2015 Copyright HP Development Company, LP
@@ -89,7 +89,7 @@ diff -up hplip-3.25.2/Makefile.am.covscan hplip-3.25.2/Makefile.am
CFLAGS+= -DCONFDIR=\"$(hplip_confdir)\"
CXXFLAGS+= -DCONFDIR=\"$(hplip_confdir)\"
-@@ -310,7 +310,7 @@ dist_pcard_DATA = pcard/__init__.py pcar
+@@ -323,7 +323,7 @@ pcardextdir = $(PYTHONEXECDIR)
pcardextdir = $(PYTHONEXECDIR)
pcardext_LTLIBRARIES = pcardext.la
pcardext_la_LDFLAGS = -module -avoid-version
@@ -98,7 +98,7 @@ diff -up hplip-3.25.2/Makefile.am.covscan hplip-3.25.2/Makefile.am
pcardext_la_CFLAGS = -I$(PYTHONINCLUDEDIR)
# prnt
-@@ -322,7 +322,7 @@ lib_LTLIBRARIES += libhpipp.la
+@@ -335,7 +335,7 @@ lib_LTLIBRARIES += libhpipp.la
#hpipp_LTLIBRARIES = hpipp.la
#hpipp_la_LDFLAGS = -module -avoid-version
libhpipp_la_SOURCES = protocol/hp_ipp.c protocol/hp_ipp.h protocol/hp_ipp_i.h
@@ -107,9 +107,9 @@ diff -up hplip-3.25.2/Makefile.am.covscan hplip-3.25.2/Makefile.am
libhpipp_la_LDFLAGS = -version-info 0:1:0
libhpipp_la_LIBADD = libhpmud.la
-diff -up hplip-3.25.2/pcard/fat.c.covscan hplip-3.25.2/pcard/fat.c
---- hplip-3.25.2/pcard/fat.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/pcard/fat.c 2025-04-11 10:21:58.036450105 +0200
+diff -up hplip-3.26.6/pcard/fat.c.covscan hplip-3.26.6/pcard/fat.c
+--- hplip-3.26.6/pcard/fat.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/pcard/fat.c 2026-09-22 16:03:14.768692504 +0200
@@ -519,14 +519,17 @@ int FatFreeSpace(void)
int FatDiskAttributes( PHOTO_CARD_ATTRIBUTES * pa )
@@ -139,9 +139,9 @@ diff -up hplip-3.25.2/pcard/fat.c.covscan hplip-3.25.2/pcard/fat.c
cwd.StartSector = ConvertClusterToSector(fa.StartCluster);
cwd.CurrSector = cwd.StartSector;
cwd.StartCluster = fa.StartCluster;
-diff -up hplip-3.25.2/prnt/hpijs/context2.cpp.covscan hplip-3.25.2/prnt/hpijs/context2.cpp
---- hplip-3.25.2/prnt/hpijs/context2.cpp.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/prnt/hpijs/context2.cpp 2025-04-11 10:21:58.036656862 +0200
+diff -up hplip-3.26.6/prnt/hpijs/context2.cpp.covscan hplip-3.26.6/prnt/hpijs/context2.cpp
+--- hplip-3.26.6/prnt/hpijs/context2.cpp.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/prnt/hpijs/context2.cpp 2026-09-22 16:03:14.769017102 +0200
@@ -1302,6 +1302,7 @@ DRIVER_ERROR PrintContext::SelectDevice
if(0 == strnlen((const char *)pSS->strDevID, DevIDBuffSize))
{
@@ -150,9 +150,9 @@ diff -up hplip-3.25.2/prnt/hpijs/context2.cpp.covscan hplip-3.25.2/prnt/hpijs/co
}
thePrinter = pPFI->CreatePrinter (pSS, familyHandle);
if (thePrinter->constructor_error != NO_ERROR)
-diff -up hplip-3.25.2/prnt/hpijs/systemservices.cpp.covscan hplip-3.25.2/prnt/hpijs/systemservices.cpp
---- hplip-3.25.2/prnt/hpijs/systemservices.cpp.covscan 2025-02-27 13:12:44.000000000 +0100
-+++ hplip-3.25.2/prnt/hpijs/systemservices.cpp 2025-04-11 10:21:58.036891582 +0200
+diff -up hplip-3.26.6/prnt/hpijs/systemservices.cpp.covscan hplip-3.26.6/prnt/hpijs/systemservices.cpp
+--- hplip-3.26.6/prnt/hpijs/systemservices.cpp.covscan 2026-09-11 13:22:15.000000000 +0200
++++ hplip-3.26.6/prnt/hpijs/systemservices.cpp 2026-09-22 16:03:14.769296084 +0200
@@ -396,7 +396,10 @@ void SystemServices::AdjustIO(IO_MODE IM
IOMode.bDevID =IM.bDevID && IOMode.bDevID;
@@ -164,29 +164,10 @@ diff -up hplip-3.25.2/prnt/hpijs/systemservices.cpp.covscan hplip-3.25.2/prnt/hp
}
APDK_END_NAMESPACE
-diff -up hplip-3.25.2/prnt/hpps/hppsfilter.c.covscan hplip-3.25.2/prnt/hpps/hppsfilter.c
---- hplip-3.25.2/prnt/hpps/hppsfilter.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/prnt/hpps/hppsfilter.c 2025-04-11 10:21:58.037072084 +0200
-@@ -329,13 +329,13 @@ static void WriteHeader(char **argument)
- /* Writing Header Information
- argument[1] = JOB ID , argument[2]= USERNAME, argument[3] = TITLE */
- hpwrite("\x1b%-12345X@PJL JOBNAME=", strlen("\x1b%-12345X@PJL JOBNAME="));
-- sprintf(buffer, "hplip_%s_%s\x0a", argument[2], argument[1]);
-+ snprintf(buffer, MAX_BUFFER-1, "hplip_%s_%s\x0a", argument[2], argument[1]);
- hpwrite(buffer, strlen(buffer));
- memset(buffer, 0, sizeof(buffer));
-- sprintf(buffer, "@PJL SET USERNAME=\"%s\"\x0a", argument[2]);
-+ snprintf(buffer, MAX_BUFFER-1, "@PJL SET USERNAME=\"%s\"\x0a", argument[2]);
- hpwrite(buffer, strlen(buffer));
- memset(buffer, 0, sizeof(buffer));
-- sprintf(buffer, "@PJL SET JOBNAME=\"%s\"\x0a", argument[3]);
-+ snprintf(buffer, MAX_BUFFER-1, "@PJL SET JOBNAME=\"%s\"\x0a", argument[3]);
- hpwrite(buffer, strlen(buffer));
- fprintf(stderr, "HP PS filter func = WriteHeader : WRITING PJL HEADER INFO\n");
- return;
-diff -up hplip-3.25.2/protocol/hp_ipp.h.covscan hplip-3.25.2/protocol/hp_ipp.h
---- hplip-3.25.2/protocol/hp_ipp.h.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/protocol/hp_ipp.h 2025-04-11 10:21:58.037239020 +0200
+diff -up hplip-3.26.6/prnt/hpps/hppsfilter.c.covscan hplip-3.26.6/prnt/hpps/hppsfilter.c
+diff -up hplip-3.26.6/protocol/hp_ipp.h.covscan hplip-3.26.6/protocol/hp_ipp.h
+--- hplip-3.26.6/protocol/hp_ipp.h.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/protocol/hp_ipp.h 2026-09-22 16:03:14.769948546 +0200
@@ -168,6 +168,11 @@ HPIPP_RESULT parseResponseHeader(char* h
HPIPP_RESULT prepend_http_header(raw_ipp *raw_request,const char *resource);
enum HPMUD_RESULT sendUSBRequest(char *buf, int size, raw_ipp *responseptr, char * device_uri);
@@ -199,9 +180,9 @@ diff -up hplip-3.25.2/protocol/hp_ipp.h.covscan hplip-3.25.2/protocol/hp_ipp.h
ipp_t * createFaxDetailRequest(const char *printer_name);
ipp_t * getDeviceFaxModemAttributes(char* device_uri,char* printer_name, int *count);
-diff -up hplip-3.25.2/scan/sane/bb_ledm.c.covscan hplip-3.25.2/scan/sane/bb_ledm.c
---- hplip-3.25.2/scan/sane/bb_ledm.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/bb_ledm.c 2025-04-11 10:21:58.037378913 +0200
+diff -up hplip-3.26.6/scan/sane/bb_ledm.c.covscan hplip-3.26.6/scan/sane/bb_ledm.c
+--- hplip-3.26.6/scan/sane/bb_ledm.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/bb_ledm.c 2026-09-22 16:03:14.770146116 +0200
@@ -26,6 +26,7 @@
# include "http.h"
# include "xml.h"
@@ -210,9 +191,9 @@ diff -up hplip-3.25.2/scan/sane/bb_ledm.c.covscan hplip-3.25.2/scan/sane/bb_ledm
# include <stdint.h>
-diff -up hplip-3.25.2/scan/sane/common.h.covscan hplip-3.25.2/scan/sane/common.h
---- hplip-3.25.2/scan/sane/common.h.covscan 2025-04-11 10:21:57.806326475 +0200
-+++ hplip-3.25.2/scan/sane/common.h 2025-04-11 10:21:58.037532413 +0200
+diff -up hplip-3.26.6/scan/sane/common.h.covscan hplip-3.26.6/scan/sane/common.h
+--- hplip-3.26.6/scan/sane/common.h.covscan 2026-09-22 16:03:14.600215636 +0200
++++ hplip-3.26.6/scan/sane/common.h 2026-09-22 16:03:14.770368503 +0200
@@ -36,7 +36,7 @@
#define _STRINGIZE(x) #x
#define STRINGIZE(x) _STRINGIZE(x)
@@ -222,9 +203,9 @@ diff -up hplip-3.25.2/scan/sane/common.h.covscan hplip-3.25.2/scan/sane/common.h
#define BUG_DUMP(data, size) bugdump((data), (size))
#define BUG_SZ(args...) {syslog(LOG_ERR, args); DBG(2, args);}
-diff -up hplip-3.25.2/scan/sane/escl.c.covscan hplip-3.25.2/scan/sane/escl.c
---- hplip-3.25.2/scan/sane/escl.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/escl.c 2025-04-11 10:21:58.037677793 +0200
+diff -up hplip-3.26.6/scan/sane/escl.c.covscan hplip-3.26.6/scan/sane/escl.c
+--- hplip-3.26.6/scan/sane/escl.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/escl.c 2026-09-22 16:03:14.770571242 +0200
@@ -849,7 +849,7 @@ SANE_Status escl_control_option(SANE_Han
//DBG8("escl_control_option (option=%s) action=%d\n", ps->option[option].name, action);
if (stat != SANE_STATUS_GOOD)
@@ -243,9 +224,9 @@ diff -up hplip-3.25.2/scan/sane/escl.c.covscan hplip-3.25.2/scan/sane/escl.c
return;
}
-diff -up hplip-3.25.2/scan/sane/http.c.covscan hplip-3.25.2/scan/sane/http.c
---- hplip-3.25.2/scan/sane/http.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/http.c 2025-04-11 10:21:58.037859247 +0200
+diff -up hplip-3.26.6/scan/sane/http.c.covscan hplip-3.26.6/scan/sane/http.c
+--- hplip-3.26.6/scan/sane/http.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/http.c 2026-09-22 16:03:14.770816752 +0200
@@ -36,6 +36,7 @@
#include <string.h>
#include <syslog.h>
@@ -254,9 +235,9 @@ diff -up hplip-3.25.2/scan/sane/http.c.covscan hplip-3.25.2/scan/sane/http.c
#include "hpmud.h"
#include "http.h"
-diff -up hplip-3.25.2/scan/sane/io.c.covscan hplip-3.25.2/scan/sane/io.c
---- hplip-3.25.2/scan/sane/io.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/io.c 2025-04-11 10:21:58.037998005 +0200
+diff -up hplip-3.26.6/scan/sane/io.c.covscan hplip-3.26.6/scan/sane/io.c
+--- hplip-3.26.6/scan/sane/io.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/io.c 2026-09-22 16:03:14.771018961 +0200
@@ -50,7 +50,7 @@ int __attribute__ ((visibility ("hidden"
if (dbus_error_is_set(&dbus_err))
@@ -284,10 +265,10 @@ diff -up hplip-3.25.2/scan/sane/io.c.covscan hplip-3.25.2/scan/sane/io.c
return 0;
}
-diff -up hplip-3.25.2/scan/sane/ledm.c.covscan hplip-3.25.2/scan/sane/ledm.c
---- hplip-3.25.2/scan/sane/ledm.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/ledm.c 2025-04-11 10:21:58.038131991 +0200
-@@ -813,7 +813,7 @@ SANE_Status ledm_control_option(SANE_Han
+diff -up hplip-3.26.6/scan/sane/ledm.c.covscan hplip-3.26.6/scan/sane/ledm.c
+--- hplip-3.26.6/scan/sane/ledm.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/ledm.c 2026-09-22 16:03:14.771200160 +0200
+@@ -819,7 +819,7 @@ SANE_Status ledm_control_option(SANE_Han
if (stat != SANE_STATUS_GOOD)
{
@@ -296,7 +277,7 @@ diff -up hplip-3.25.2/scan/sane/ledm.c.covscan hplip-3.25.2/scan/sane/ledm.c
}
return stat;
-@@ -1078,7 +1078,7 @@ void ledm_close(SANE_Handle handle)
+@@ -1084,7 +1084,7 @@ void ledm_close(SANE_Handle handle)
if (ps == NULL || ps != session)
{
@@ -305,9 +286,9 @@ diff -up hplip-3.25.2/scan/sane/ledm.c.covscan hplip-3.25.2/scan/sane/ledm.c
return;
}
-diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell.c
---- hplip-3.25.2/scan/sane/marvell.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/marvell.c 2025-04-11 10:21:58.038309394 +0200
+diff -up hplip-3.26.6/scan/sane/marvell.c.covscan hplip-3.26.6/scan/sane/marvell.c
+--- hplip-3.26.6/scan/sane/marvell.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/marvell.c 2026-09-22 16:03:14.771482018 +0200
@@ -134,7 +134,7 @@ static int get_ip_data(struct marvell_se
if (!ps->ip_handle)
@@ -362,7 +343,7 @@ diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell
return;
}
-@@ -849,7 +849,7 @@ SANE_Status marvell_control_option(SANE_
+@@ -853,7 +853,7 @@ SANE_Status marvell_control_option(SANE_
stat = SANE_STATUS_GOOD;
break;
}
@@ -371,7 +352,7 @@ diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell
}
else
{ /* Set default. */
-@@ -866,7 +866,7 @@ SANE_Status marvell_control_option(SANE_
+@@ -870,7 +870,7 @@ SANE_Status marvell_control_option(SANE_
if (stat != SANE_STATUS_GOOD)
{
@@ -380,7 +361,7 @@ diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell
action==SANE_ACTION_GET_VALUE ? "get" : action==SANE_ACTION_SET_VALUE ? "set" : "auto");
}
-@@ -905,7 +905,7 @@ SANE_Status marvell_start(SANE_Handle ha
+@@ -909,7 +909,7 @@ SANE_Status marvell_start(SANE_Handle ha
if (set_extents(ps))
{
@@ -389,7 +370,7 @@ diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell
ps->currentTlx, ps->currentTly, ps->currentBrx, ps->currentBry, ps->min_width, ps->min_height, ps->tlxRange.max, ps->tlyRange.max);
stat = SANE_STATUS_INVAL;
goto bugout;
-@@ -963,7 +963,7 @@ SANE_Status marvell_start(SANE_Handle ha
+@@ -967,7 +967,7 @@ SANE_Status marvell_start(SANE_Handle ha
/* Open image processor. */
if ((ret = ipOpen(pXform-xforms, xforms, 0, &ps->ip_handle)) != IP_DONE)
{
@@ -398,7 +379,7 @@ diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell
stat = SANE_STATUS_INVAL;
goto bugout;
}
-@@ -1023,7 +1023,7 @@ SANE_Status marvell_read(SANE_Handle han
+@@ -1027,7 +1027,7 @@ SANE_Status marvell_read(SANE_Handle han
if(ret & (IP_INPUT_ERROR | IP_FATAL_ERROR))
{
@@ -407,18 +388,10 @@ diff -up hplip-3.25.2/scan/sane/marvell.c.covscan hplip-3.25.2/scan/sane/marvell
goto bugout;
}
-diff -up hplip-3.25.2/scan/sane/sclpml.c.covscan hplip-3.25.2/scan/sane/sclpml.c
---- hplip-3.25.2/scan/sane/sclpml.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/sclpml.c 2025-04-11 10:21:58.038605168 +0200
-@@ -30,6 +30,7 @@
- #include <unistd.h>
- #include <fcntl.h>
- #include <string.h>
-+#include <sys/time.h>
- #include "sane.h"
- #include "saneopts.h"
- #include "common.h"
-@@ -2090,7 +2091,7 @@ void sclpml_close(SANE_Handle handle)
+diff -up hplip-3.26.6/scan/sane/sclpml.c.covscan hplip-3.26.6/scan/sane/sclpml.c
+--- hplip-3.26.6/scan/sane/sclpml.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/sclpml.c 2026-09-22 16:03:14.771631551 +0200
+@@ -2117,7 +2117,7 @@ void sclpml_close(SANE_Handle handle)
DBG(8, "sane_hpaio_close(): %s %d\n", __FILE__, __LINE__);
if (hpaio == NULL || hpaio != session)
{
@@ -427,9 +400,9 @@ diff -up hplip-3.25.2/scan/sane/sclpml.c.covscan hplip-3.25.2/scan/sane/sclpml.c
return;
}
-diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
---- hplip-3.25.2/scan/sane/soap.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/soap.c 2025-04-11 10:21:58.038894758 +0200
+diff -up hplip-3.26.6/scan/sane/soap.c.covscan hplip-3.26.6/scan/sane/soap.c
+--- hplip-3.26.6/scan/sane/soap.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/soap.c 2026-09-22 16:03:14.772359141 +0200
@@ -142,7 +142,7 @@ static int get_ip_data(struct soap_sessi
if (!ps->ip_handle)
@@ -475,7 +448,7 @@ diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
return;
}
-@@ -824,7 +824,7 @@ SANE_Status soap_control_option(SANE_Han
+@@ -828,7 +828,7 @@ SANE_Status soap_control_option(SANE_Han
if (stat != SANE_STATUS_GOOD)
{
@@ -484,7 +457,7 @@ diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
action==SANE_ACTION_GET_VALUE ? "get" : action==SANE_ACTION_SET_VALUE ? "set" : "auto");
}
-@@ -862,7 +862,7 @@ SANE_Status soap_start(SANE_Handle handl
+@@ -866,7 +866,7 @@ SANE_Status soap_start(SANE_Handle handl
ps->user_cancel = 0;
if (set_extents(ps))
{
@@ -493,7 +466,7 @@ diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
ps->currentTlx, ps->currentTly, ps->currentBrx, ps->currentBry, ps->min_width, ps->min_height, ps->tlxRange.max, ps->tlyRange.max);
stat = SANE_STATUS_INVAL;
goto bugout;
-@@ -913,7 +913,7 @@ SANE_Status soap_start(SANE_Handle handl
+@@ -917,7 +917,7 @@ SANE_Status soap_start(SANE_Handle handl
/* Open image processor. */
if ((ret = ipOpen(pXform-xforms, xforms, 0, &ps->ip_handle)) != IP_DONE)
{
@@ -502,7 +475,7 @@ diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
stat = SANE_STATUS_INVAL;
goto bugout;
}
-@@ -955,7 +955,7 @@ SANE_Status soap_start(SANE_Handle handl
+@@ -959,7 +959,7 @@ SANE_Status soap_start(SANE_Handle handl
if (ret & (IP_INPUT_ERROR | IP_FATAL_ERROR | IP_DONE))
{
@@ -511,7 +484,7 @@ diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
stat = SANE_STATUS_IO_ERROR;
goto bugout;
}
-@@ -1007,7 +1007,7 @@ SANE_Status soap_read(SANE_Handle handle
+@@ -1011,7 +1011,7 @@ SANE_Status soap_read(SANE_Handle handle
if(ret & (IP_INPUT_ERROR | IP_FATAL_ERROR))
{
@@ -520,9 +493,9 @@ diff -up hplip-3.25.2/scan/sane/soap.c.covscan hplip-3.25.2/scan/sane/soap.c
goto bugout;
}
-diff -up hplip-3.25.2/scan/sane/soapht.c.covscan hplip-3.25.2/scan/sane/soapht.c
---- hplip-3.25.2/scan/sane/soapht.c.covscan 2025-02-27 13:12:29.000000000 +0100
-+++ hplip-3.25.2/scan/sane/soapht.c 2025-04-11 10:21:58.039106018 +0200
+diff -up hplip-3.26.6/scan/sane/soapht.c.covscan hplip-3.26.6/scan/sane/soapht.c
+--- hplip-3.26.6/scan/sane/soapht.c.covscan 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/scan/sane/soapht.c 2026-09-22 16:03:14.772652079 +0200
@@ -136,7 +136,7 @@ static int get_ip_data(struct soap_sessi
if (!ps->ip_handle)
@@ -568,7 +541,7 @@ diff -up hplip-3.25.2/scan/sane/soapht.c.covscan hplip-3.25.2/scan/sane/soapht.c
return;
}
-@@ -904,7 +904,7 @@ SANE_Status soapht_control_option(SANE_H
+@@ -910,7 +910,7 @@ SANE_Status soapht_control_option(SANE_H
if (stat != SANE_STATUS_GOOD)
{
@@ -577,7 +550,7 @@ diff -up hplip-3.25.2/scan/sane/soapht.c.covscan hplip-3.25.2/scan/sane/soapht.c
action==SANE_ACTION_GET_VALUE ? "get" : action==SANE_ACTION_SET_VALUE ? "set" : "auto");
}
-@@ -946,7 +946,7 @@ SANE_Status soapht_start(SANE_Handle han
+@@ -952,7 +952,7 @@ SANE_Status soapht_start(SANE_Handle han
if (set_extents(ps))
{
@@ -586,7 +559,7 @@ diff -up hplip-3.25.2/scan/sane/soapht.c.covscan hplip-3.25.2/scan/sane/soapht.c
ps->currentTlx, ps->currentTly, ps->currentBrx, ps->currentBry, ps->min_width, ps->min_height, ps->tlxRange.max, ps->tlyRange.max);
stat = SANE_STATUS_INVAL;
goto bugout;
-@@ -1032,7 +1032,7 @@ SANE_Status soapht_start(SANE_Handle han
+@@ -1038,7 +1038,7 @@ SANE_Status soapht_start(SANE_Handle han
/* Open image processor. */
if ((ret = ipOpen(pXform-xforms, xforms, 0, &ps->ip_handle)) != IP_DONE)
{
@@ -595,7 +568,7 @@ diff -up hplip-3.25.2/scan/sane/soapht.c.covscan hplip-3.25.2/scan/sane/soapht.c
stat = SANE_STATUS_INVAL;
goto bugout;
}
-@@ -1075,7 +1075,7 @@ SANE_Status soapht_start(SANE_Handle han
+@@ -1081,7 +1081,7 @@ SANE_Status soapht_start(SANE_Handle han
if (ret & (IP_INPUT_ERROR | IP_FATAL_ERROR | IP_DONE))
{
@@ -604,7 +577,7 @@ diff -up hplip-3.25.2/scan/sane/soapht.c.covscan hplip-3.25.2/scan/sane/soapht.c
stat = SANE_STATUS_IO_ERROR;
goto bugout;
}
-@@ -1124,7 +1124,7 @@ SANE_Status soapht_read(SANE_Handle hand
+@@ -1130,7 +1130,7 @@ SANE_Status soapht_read(SANE_Handle hand
if(ret & (IP_INPUT_ERROR | IP_FATAL_ERROR))
{
diff --git a/hplip-curl-fallback.patch b/hplip-curl-fallback.patch
index 596a82c..ecdbad7 100644
--- a/hplip-curl-fallback.patch
+++ b/hplip-curl-fallback.patch
@@ -1,17 +1,15 @@
-diff --git a/installer/pluginhandler.py b/installer/pluginhandler.py
-index c2e2a94..d10d1b9 100755
---- a/installer/pluginhandler.py
-+++ b/installer/pluginhandler.py
-@@ -36,7 +36,7 @@ def get_checksum(s):
+diff -up hplip-3.26.6/installer/pluginhandler.py.curl-fallback hplip-3.26.6/installer/pluginhandler.py
+--- hplip-3.26.6/installer/pluginhandler.py.curl-fallback 2026-09-23 12:57:09.452450795 +0200
++++ hplip-3.26.6/installer/pluginhandler.py 2026-09-23 13:40:36.665628402 +0200
+@@ -46,6 +46,7 @@ PLUGIN_FALLBACK_URLS = {
+ '3.25.6': 'https://developers.hp.com/sites/default/files/2025-08/hplip-3.25.6-plugin.run',
+ '3.25.8': 'https://developers.hp.com/sites/default/files/2025-11/hplip-3.25.8-plugin.run',
+ '3.26.4': 'https://developers.hp.com/sites/default/files/2026-05/hplip-3.26.4-plugin.run',
++ '3.26.6': 'https://developers.hp.com/sites/default/files/2026-09/hplip-3.26.6-plugin.run',
+ }
-
- PLUGIN_STATE_FILE = '/var/lib/hp/hplip.state'
--PLUGIN_FALLBACK_LOCATION = 'https://developers.hp.com/sites/default/files/'
-+PLUGIN_FALLBACK_LOCATION = 'https://developers.hp.com/sites/default/files/2026-05/'
-
-
-
-@@ -281,7 +281,7 @@ class PluginHandle(object):
+ WGET_FALLBACK_HEADERS = (
+@@ -328,7 +329,7 @@ class PluginHandle(object):
else:
curl = utils.which("curl", True)
if curl:
@@ -20,21 +18,12 @@ index c2e2a94..d10d1b9 100755
log.debug(cmd)
status, output = utils.run(cmd)
log.debug("curl returned: %d" % status)
-@@ -290,7 +290,7 @@ class PluginHandle(object):
- if status != 0 or os_utils.getFileSize(plugin_file) <= 0:
- src = os.path.join(PLUGIN_FALLBACK_LOCATION, self.__plugin_name)
+@@ -339,7 +340,7 @@ class PluginHandle(object):
+ src = (PLUGIN_FALLBACK_URLS.get(self.__required_version) or
+ os.path.join(PLUGIN_FALLBACK_LOCATION, self.__plugin_name))
log.info("Plugin is not accessible. Trying to download it from fallback location: [%s]" % src)
- cmd = "%s --create-dirs -O --output-dir %s --location %s" % (curl,self.__plugin_path,src)
-+ cmd = "%s -f --user-agent 'Mozilla/5.0 (compatible; hplip-plugin/1.0)' --create-dirs -O --output-dir %s --location %s" % (curl,self.__plugin_path,src)
++ cmd = "%s --create-dirs -O %s --output-dir %s --location %s" % (curl, WGET_FALLBACK_HEADERS, self.__plugin_path, src)
log.debug(cmd)
status, output = utils.run(cmd)
-@@ -318,7 +318,7 @@ class PluginHandle(object):
- if digsig_url.startswith('file://'):
- status, filename = utils.download_from_network(digsig_url, digsig_file, True)
- else:
-- cmd = "%s --create-dirs -O --output-dir %s --location %s" % (curl, self.__plugin_path,digsig_url)
-+ cmd = "%s -f --user-agent 'Mozilla/5.0 (compatible; hplip-plugin/1.0)' --create-dirs -O --output-dir %s --location %s" % (curl, self.__plugin_path,digsig_url)
- log.debug(cmd)
- status, output = utils.run(cmd)
- except IOError as e:
diff --git a/hplip-hpmud-string-parse.patch b/hplip-hpmud-string-parse.patch
index 58bf5dd..5c45a65 100644
--- a/hplip-hpmud-string-parse.patch
+++ b/hplip-hpmud-string-parse.patch
@@ -1,9 +1,8 @@
-diff --git a/io/hpmud/model.c b/io/hpmud/model.c
-index 4ea8990..72c630b 100644
---- a/io/hpmud/model.c
-+++ b/io/hpmud/model.c
-@@ -420,7 +420,10 @@ static int ParseFile(char *datFile, char *model, char *attr, int attrSize, int *
- strncpy(section, rcbuf+1, sizeof(section)); /* found new section */
+diff -up hplip-3.26.6/io/hpmud/model.c.hpmud-string-parse hplip-3.26.6/io/hpmud/model.c
+--- hplip-3.26.6/io/hpmud/model.c.hpmud-string-parse 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/io/hpmud/model.c 2026-09-22 16:02:27.113461684 +0200
+@@ -422,7 +422,10 @@ static int ParseFile(char *datFile, char
+ section[sizeof(section)-1] = '\0';
n = strlen(section);
section[n-2]=0; /* remove ']' and CR */
- if (strcasecmp(model, section) == 0)
diff --git a/hplip-logdir.patch b/hplip-logdir.patch
index 702d328..ee072e7 100644
--- a/hplip-logdir.patch
+++ b/hplip-logdir.patch
@@ -1,18 +1,7 @@
-diff -up hplip-3.21.12/prnt/hpcups/HPCupsFilter.cpp.logdir hplip-3.21.12/prnt/hpcups/HPCupsFilter.cpp
---- hplip-3.21.12/prnt/hpcups/HPCupsFilter.cpp.logdir 2022-01-12 11:27:25.509348511 +0100
-+++ hplip-3.21.12/prnt/hpcups/HPCupsFilter.cpp 2022-01-12 11:29:11.507661838 +0100
-@@ -669,7 +669,7 @@ int HPCupsFilter::processRasterData(cups
- char hpPreProcessedRasterFile[MAX_FILE_PATH_LEN]; //temp file needed to store raster data with swaped pages.
-
-
-- sprintf(hpPreProcessedRasterFile, "%s/hp_%s_cups_SwapedPagesXXXXXX",CUPS_TMP_DIR, m_JA.user_name);
-+ snprintf(hpPreProcessedRasterFile, sizeof (hpPreProcessedRasterFile), "%s/hp_%s_cups_SwapedPagesXXXXXX",CUPS_TMP_DIR, m_JA.user_name);
- #ifndef DISABLE_IMAGEPROCESSOR
- image_processor_t* imageProcessor=NULL;
- IMAGE_PROCESSOR_ERROR result;
-diff -up hplip-3.21.12/prnt/hpcups/SystemServices.cpp.logdir hplip-3.21.12/prnt/hpcups/SystemServices.cpp
---- hplip-3.21.12/prnt/hpcups/SystemServices.cpp.logdir 2021-12-13 10:07:36.000000000 +0100
-+++ hplip-3.21.12/prnt/hpcups/SystemServices.cpp 2022-01-12 11:27:25.509348511 +0100
+diff -up hplip-3.26.6/prnt/hpcups/HPCupsFilter.cpp.logdir hplip-3.26.6/prnt/hpcups/HPCupsFilter.cpp
+diff -up hplip-3.26.6/prnt/hpcups/SystemServices.cpp.logdir hplip-3.26.6/prnt/hpcups/SystemServices.cpp
+--- hplip-3.26.6/prnt/hpcups/SystemServices.cpp.logdir 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/prnt/hpcups/SystemServices.cpp 2026-09-22 15:36:27.355377560 +0200
@@ -38,7 +38,7 @@ SystemServices::SystemServices(int iLogL
if (iLogLevel & SAVE_OUT_FILE)
{
diff --git a/hplip-model-mismatch.patch b/hplip-model-mismatch.patch
index 1dbe3c0..8dd3948 100644
--- a/hplip-model-mismatch.patch
+++ b/hplip-model-mismatch.patch
@@ -1,8 +1,7 @@
-diff --git a/io/hpmud/jd.c b/io/hpmud/jd.c
-index 20df27a..7ed4918 100644
---- a/io/hpmud/jd.c
-+++ b/io/hpmud/jd.c
-@@ -208,7 +208,22 @@ enum HPMUD_RESULT __attribute__ ((visibility ("hidden"))) jd_open(mud_device *pd
+diff -up hplip-3.26.6/io/hpmud/jd.c.model-mismatch hplip-3.26.6/io/hpmud/jd.c
+--- hplip-3.26.6/io/hpmud/jd.c.model-mismatch 2026-09-22 16:06:38.784863684 +0200
++++ hplip-3.26.6/io/hpmud/jd.c 2026-09-22 16:06:38.804916490 +0200
+@@ -209,7 +209,22 @@ enum HPMUD_RESULT __attribute__ ((visibi
{
/* Make sure uri model matches device id model. */
hpmud_get_uri_model(pd->uri, uri_model, sizeof(uri_model));
@@ -25,11 +24,10 @@ index 20df27a..7ed4918 100644
if (strcasecmp(uri_model, model) != 0)
{
stat = HPMUD_R_INVALID_URI; /* different device plugged in */
-diff --git a/io/hpmud/model.c b/io/hpmud/model.c
-index d546ec1..adb3d87 100644
---- a/io/hpmud/model.c
-+++ b/io/hpmud/model.c
-@@ -407,7 +407,10 @@ static int ParseFile(char *datFile, char *model, char *attr, int attrSize, int *
+diff -up hplip-3.26.6/io/hpmud/model.c.model-mismatch hplip-3.26.6/io/hpmud/model.c
+--- hplip-3.26.6/io/hpmud/model.c.model-mismatch 2026-09-22 16:06:38.785079549 +0200
++++ hplip-3.26.6/io/hpmud/model.c 2026-09-22 16:08:05.192457848 +0200
+@@ -408,7 +408,10 @@ static int ParseFile(char *datFile, char
char rcbuf[255];
char section[128];
char file[128];
@@ -41,8 +39,8 @@ index d546ec1..adb3d87 100644
if ((fp = fopen(datFile, "r")) == NULL)
goto bugout;
-@@ -422,10 +425,17 @@ static int ParseFile(char *datFile, char *model, char *attr, int attrSize, int *
- strncpy(section, rcbuf+1, sizeof(section)); /* found new section */
+@@ -424,10 +427,17 @@ static int ParseFile(char *datFile, char
+ section[sizeof(section)-1] = '\0';
n = strlen(section);
section[n-2]=0; /* remove ']' and CR */
+ n -= 2;
diff --git a/hplip-plugin-curl.patch b/hplip-plugin-curl.patch
index 380ce9b..cdba3a3 100644
--- a/hplip-plugin-curl.patch
+++ b/hplip-plugin-curl.patch
@@ -1,14 +1,13 @@
-diff --git a/installer/pluginhandler.py b/installer/pluginhandler.py
-index 56683fb..031ceec 100755
---- a/installer/pluginhandler.py
-+++ b/installer/pluginhandler.py
-@@ -185,14 +185,16 @@ class PluginHandle(object):
+diff -up hplip-3.26.6/installer/pluginhandler.py.curl-switch hplip-3.26.6/installer/pluginhandler.py
+--- hplip-3.26.6/installer/pluginhandler.py.curl-switch 2026-09-23 12:12:49.610423012 +0200
++++ hplip-3.26.6/installer/pluginhandler.py 2026-09-23 12:54:30.890523466 +0200
+@@ -224,14 +224,16 @@ class PluginHandle(object):
if self.__plugin_conf_file.startswith('file://'):
status, filename = utils.download_from_network(self.__plugin_conf_file, local_conf, True)
else:
- wget = utils.which("wget", True)
- if wget:
-- status, output = utils.run("%s --tries=3 --timeout=60 --output-document=%s %s --cache=off" %(wget, local_conf, self.__plugin_conf_file))
+- status, output = utils.run("%s --timeout=60 --output-document=%s %s --cache=off" %(wget, local_conf, self.__plugin_conf_file))
+ curl = utils.which("curl", True)
+ if curl:
+ cmd = "%s --retry 3 --max-time 10 --output %s --location %s" %(curl, local_conf, self.__plugin_conf_file)
@@ -23,7 +22,7 @@ index 56683fb..031ceec 100755
return status, url, check_sum
except IOError as e:
log.error("I/O Error: %s" % e.strerror)
-@@ -284,18 +284,18 @@ class PluginHandle(object):
+@@ -324,12 +326,12 @@ class PluginHandle(object):
if src.startswith('file://'):
status, filename = utils.download_from_network(src, plugin_file, True)
else:
@@ -40,19 +39,24 @@ index 56683fb..031ceec 100755
#Check whether plugin is accessible in Openprinting.org website otherwise dowload plugin from alternate location.
if status != 0 or os_utils.getFileSize(plugin_file) <= 0:
- src = os.path.join(PLUGIN_FALLBACK_LOCATION, self.__plugin_name)
+@@ -337,7 +339,7 @@ class PluginHandle(object):
+ src = (PLUGIN_FALLBACK_URLS.get(self.__required_version) or
+ os.path.join(PLUGIN_FALLBACK_LOCATION, self.__plugin_name))
log.info("Plugin is not accessible. Trying to download it from fallback location: [%s]" % src)
-- cmd = "%s --cache=off -P %s %s" % (wget,self.__plugin_path,src)
+- cmd = "%s --cache=off %s -P %s %s" % (wget, WGET_FALLBACK_HEADERS, self.__plugin_path, src)
+ cmd = "%s --create-dirs -O --output-dir %s --location %s" % (curl,self.__plugin_path,src)
log.debug(cmd)
status, output = utils.run(cmd)
-@@ -323,7 +323,7 @@ class PluginHandle(object):
- if digsig_url.startswith('file://'):
+@@ -366,9 +368,9 @@ class PluginHandle(object):
status, filename = utils.download_from_network(digsig_url, digsig_file, True)
else:
-- cmd = "%s --cache=off -P %s %s" % (wget,self.__plugin_path,digsig_url)
-+ cmd = "%s --create-dirs -O --output-dir %s --location %s" % (curl, self.__plugin_path,digsig_url)
+ if using_fallback:
+- cmd = "%s --cache=off %s -P %s %s" % (wget, WGET_FALLBACK_HEADERS, self.__plugin_path, digsig_url)
++ cmd = "%s --create-dirs -O %s --output-dir %s --location %s" % (curl, WGET_FALLBACK_HEADERS, self.__plugin_path, digsig_url)
+ else:
+- cmd = "%s --cache=off -P %s %s" % (wget, self.__plugin_path, digsig_url)
++ cmd = "%s --create-dirs -O --output-dir %s --location %s" % (curl, self.__plugin_path, digsig_url)
log.debug(cmd)
status, output = utils.run(cmd)
except IOError as e:
diff --git a/hplip-plugin-script.patch b/hplip-plugin-script.patch
index 9b3c196..0e61214 100644
--- a/hplip-plugin-script.patch
+++ b/hplip-plugin-script.patch
@@ -1,8 +1,17 @@
-diff --git a/Makefile.am b/Makefile.am
-index bb4195c..ddac16a 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -680,6 +680,12 @@ if HPLIP_CLASS_DRIVER
+diff -up hplip-3.26.6/configure.in.plugin-patch hplip-3.26.6/configure.in
+--- hplip-3.26.6/configure.in.plugin-patch 2026-09-22 16:24:20.379157340 +0200
++++ hplip-3.26.6/configure.in 2026-09-22 16:28:58.824106255 +0200
+@@ -873,5 +873,5 @@ AC_SUBST(udev_sysfs_rules)
+ AC_SUBST(epm_class_driver)
+ AC_SUBST(epm_class_install)
+
+-AC_CONFIG_FILES(Makefile hplip.conf hplip.desktop hp-uiscan.desktop hplip-systray.desktop prnt/drv/hpijs.drv prnt/drv/hpcups.drv hplip.list)
++AC_CONFIG_FILES(Makefile hplip.conf hplip.desktop hp-uiscan.desktop hplip-systray.desktop prnt/drv/hpijs.drv prnt/drv/hpcups.drv hplip.list hp-plugin)
+ AC_OUTPUT
+diff -up hplip-3.26.6/Makefile.am.plugin-patch hplip-3.26.6/Makefile.am
+--- hplip-3.26.6/Makefile.am.plugin-patch 2026-09-22 16:24:20.354636421 +0200
++++ hplip-3.26.6/Makefile.am 2026-09-22 16:24:20.402254262 +0200
+@@ -700,6 +700,12 @@ if HPLIP_CLASS_DRIVER
filterdir=$(cupsfilterdir)
printpluginsdir=$(cupsfilterdir)
@@ -15,14 +24,3 @@ index bb4195c..ddac16a 100644
dist_filter_DATA = hpcups hpps dat2drv
dist_printplugins_DATA = prnt/plugins/hbpl1-arm32.so prnt/plugins/hbpl1-arm64.so prnt/plugins/hbpl1-x86_32.so prnt/plugins/hbpl1-x86_64.so prnt/plugins/lj-arm32.so prnt/plugins/lj-arm64.so prnt/plugins/lj-x86_32.so prnt/plugins/lj-x86_64.so
-diff --git a/configure.in b/configure.in
-index f8f1a28..7fa5d12 100644
---- a/configure.in
-+++ b/configure.in
-@@ -801,5 +801,5 @@ AC_SUBST(udev_sysfs_rules)
- AC_SUBST(epm_class_driver)
- AC_SUBST(epm_class_install)
-
--AC_CONFIG_FILES(Makefile hplip.conf hplip.desktop hp-uiscan.desktop hplip-systray.desktop prnt/drv/hpijs.drv prnt/drv/hpcups.drv hplip.list data/policykit/com.hp.hplip.service)
-+AC_CONFIG_FILES(Makefile hplip.conf hplip.desktop hp-uiscan.desktop hplip-systray.desktop prnt/drv/hpijs.drv prnt/drv/hpcups.drv hplip.list data/policykit/com.hp.hplip.service hp-plugin)
- AC_OUTPUT
diff --git a/hplip-plugin-udevissues.patch b/hplip-plugin-udevissues.patch
index 3a35c6b..887fd73 100644
--- a/hplip-plugin-udevissues.patch
+++ b/hplip-plugin-udevissues.patch
@@ -1,12 +1,13 @@
-diff --git a/installer/pluginhandler.py b/installer/pluginhandler.py
-index 1af8d85..5c498ab 100755
---- a/installer/pluginhandler.py
-+++ b/installer/pluginhandler.py
-@@ -403,7 +403,20 @@ class PluginHandle(object):
+diff -up hplip-3.26.6/installer/pluginhandler.py.hpplugin-udevperms hplip-3.26.6/installer/pluginhandler.py
+--- hplip-3.26.6/installer/pluginhandler.py.hpplugin-udevperms 2026-09-22 16:08:54.950927474 +0200
++++ hplip-3.26.6/installer/pluginhandler.py 2026-09-22 16:23:46.759730552 +0200
+@@ -462,9 +462,22 @@ class PluginHandle(object):
log.error("Target file %s does not exist. File copy failed." % trg)
continue
else:
-- os.chmod(trg, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP | stat.S_IROTH | stat.S_IXOTH)
+- # Make plugin .so files readable/executable by all users
+- os.chmod(trg, 0o755)
+- log.debug("Set plugin file to 0o755: %s" % trg)
+ if trg == '/etc/udev/rules.d/S99-2000S1.rules' or \
+ trg == '/etc/udev/rules.d/40-libsane.rules':
+ os.chmod(trg, 0o644)
@@ -20,7 +21,9 @@ index 1af8d85..5c498ab 100755
+ udev_f.write(content)
+
+ else:
-+ os.chmod(trg, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP | stat.S_IROTH | stat.S_IXOTH)
++ # Make plugin .so files readable/executable by all users
++ os.chmod(trg, 0o755)
++ log.debug("Set plugin file to 0o755: %s" % trg)
if link:
if os.path.exists(link):
diff --git a/hplip-pstotiff-is-rubbish.patch b/hplip-pstotiff-is-rubbish.patch
index 901e6a2..a4edd9f 100644
--- a/hplip-pstotiff-is-rubbish.patch
+++ b/hplip-pstotiff-is-rubbish.patch
@@ -1,11 +1,12 @@
-diff -up hplip-3.15.2/fax/filters/pstotiff.pstotiff-is-rubbish hplip-3.15.2/fax/filters/pstotiff
---- hplip-3.15.2/fax/filters/pstotiff.pstotiff-is-rubbish 2015-02-04 09:40:43.169147058 +0100
-+++ hplip-3.15.2/fax/filters/pstotiff 2015-02-04 09:47:20.786983832 +0100
-@@ -1,45 +1,16 @@
+diff -up hplip-3.26.6/fax/filters/pstotiff.pstotiff-is-rubbish hplip-3.26.6/fax/filters/pstotiff
+--- hplip-3.26.6/fax/filters/pstotiff.pstotiff-is-rubbish 2026-09-11 13:22:00.000000000 +0200
++++ hplip-3.26.6/fax/filters/pstotiff 2026-09-22 15:18:10.139318027 +0200
+@@ -1,46 +1,16 @@
-#!/usr/bin/env python
-
-import os
-import os.path
+-import shlex
-import time
-import sys
-import tempfile
@@ -18,7 +19,7 @@ diff -up hplip-3.15.2/fax/filters/pstotiff.pstotiff-is-rubbish hplip-3.15.2/fax/
-temp_in_file = "-"
-
-if (len(sys.argv) > 6):
-- temp_in_file = sys.argv[6]
+- temp_in_file = shlex.quote(sys.argv[6]) # HPLIP-2026-008: quote argv[6] before shell execution.
-
-temp_out_handle, temp_out_fname = tempfile.mkstemp()
-
diff --git a/hplip-sclpml-strcasestr.patch b/hplip-sclpml-strcasestr.patch
index daf86c8..0d01761 100644
--- a/hplip-sclpml-strcasestr.patch
+++ b/hplip-sclpml-strcasestr.patch
@@ -1,16 +1,12 @@
-Switch the whole libsane-hpaio to get proper definition of strcasestr() used in
-sclpml.c
-
-diff --git a/Makefile.am b/Makefile.am
-index 15d953a..7105f74 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -73,7 +73,7 @@ endif
+diff -up hplip-3.26.6/Makefile.am.sclpml-strcasestr hplip-3.26.6/Makefile.am
+--- hplip-3.26.6/Makefile.am.sclpml-strcasestr 2026-09-22 16:29:49.093383127 +0200
++++ hplip-3.26.6/Makefile.am 2026-09-22 18:02:36.209133647 +0200
+@@ -84,7 +84,7 @@ endif
# The following is a interlibrary dependency that must be compiled first.
libsane_hpaio_la_LIBADD = libhpip.la libhpmud.la libhpipp.la $(DBUS_LIBS) -lcups -ldl
#libsane_hpaio_la_CFLAGS = -DWITH_NONAMESPACES -DSOAP_DEBUG
--libsane_hpaio_la_CFLAGS = $(DBUS_CFLAGS) -Iprotocol
-+libsane_hpaio_la_CFLAGS = $(DBUS_CFLAGS) -Iprotocol -D_GNU_SOURCE
+-libsane_hpaio_la_CFLAGS = $(DBUS_CFLAGS) -Iprotocol $(SECURITY_CFLAGS)
++libsane_hpaio_la_CFLAGS = $(DBUS_CFLAGS) -Iprotocol $(SECURITY_CFLAGS) -D_GNU_SOURCE
+ libsane_hpaio_la_LDFLAGS += $(SECURITY_LDFLAGS)
if NETWORK_BUILD
- libsane_hpaio_la_LIBADD += libhpdiscovery.la
diff --git a/hplip.spec b/hplip.spec
index f1d3a86..2f732f5 100644
--- a/hplip.spec
+++ b/hplip.spec
@@ -6,8 +6,8 @@
Summary: HP Linux Imaging and Printing Project
Name: hplip
-Version: 3.26.4
-Release: 9%{?dist}
+Version: 3.26.6
+Release: 1%{?dist}
# most files (base/*, *, ui*/...) - GPL2+
# prnt/hpijs/ jpeg related files - IJG
# prnt/* - BSD-3-Clause-HP - it is modified a little, asked here https://gitlab.com/fedora/legal/fedora-license-data/-/issues/267
@@ -260,9 +260,6 @@ Patch73: hplip-plugin-stdout.patch
# - connecting to HP site requires curl/wget to set user-agent to pretend to be a browser
# https://bugs.launchpad.net/hplip/+bug/2154206
Patch74: hplip-curl-fallback.patch
-# OSH fixes after CVE-2026-8631
-# https://bugs.launchpad.net/hplip/+bug/2156584
-Patch75: hplip-CVE-2026-8631-osh.patch
%if 0%{?fedora} || 0%{?rhel} <= 8
# mention hplip-gui if you want to have GUI
@@ -628,8 +625,6 @@ done
%patch -P 73 -p1 -b .plugin-stdout
# https://bugs.launchpad.net/hplip/+bug/2154206
%patch -P 74 -p1 -b .curl-fallback
-# OSH fixes after CVE-2026-8631
-%patch -P 75 -p1 -b .cve-2026-8631-osh
# Fedora specific patches now, don't put a generic patches under it
%if 0%{?fedora} || 0%{?rhel} <= 8
@@ -1001,6 +996,10 @@ find doc/images -type f -exec chmod 644 {} \;
%config(noreplace) %{_sysconfdir}/sane.d/dll.d/hpaio
%changelog
+* Wed Sep 23 2026 Zdenek Dohnal <zdohnal@redhat.com> - 3.26.6-1
+- 3.26.6, fixes CVE-2026-91105,CVE-2026-91103,CVE-2026-91102,CVE-2026-91101,
+ CVE-2026-91100,CVE-2026-91099,CVE-2026-91098,CVE-2026-91097
+
* Wed Jul 22 2026 Python Maint <python-maint@redhat.com> - 3.26.4-9
- Rebuilt for Python 3.15.0b4 ABI change
diff --git a/sources b/sources
index 0574f21..c16688f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (hplip-3.26.4-repack.tar.gz) = e46eb44780afdc13f975a2de23a7fcef51659d96506125a76f23f9e47135a6bd3aab60f70f4b52ad088714f967031324c9f537b4af21e394a49eae9bb94742f4
+SHA512 (hplip-3.26.6-repack.tar.gz) = 69464e4e3e7cbab1d14ab82ab88550e3a2953b95da9f327c040a1204561f81cbd1a964fb9f90a8f7cdca70682e6e59b934a634f2676dd4d8851c5680cbab4ded
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-23 13:15 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 13:15 [rpms/hplip] f43: 3.26.6, fixes CVE-2026-91105,CVE-2026-91103,CVE-2026-91102,CVE-2026-91101, Zdenek Dohnal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox