[ASA-202005-4] a2ps: multiple issues
foxboron at archlinux.org
Mon May 11 18:10:35 UTC 2020
Arch Linux Security Advisory ASA-202005-4
Date : 2020-05-06
CVE-ID : CVE-2014-0466 CVE-2015-8107
Package : a2ps
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-1150
The package a2ps before version 4.14-9 is vulnerable to multiple issues
including arbitrary command execution and arbitrary code execution.
Upgrade to 4.14-9.
# pacman -Syu "a2ps>=4.14-9"
The problems have been fixed upstream but no release is available yet.
- CVE-2014-0466 (arbitrary command execution)
The fixps script in a2ps 4.14 does not use the -dSAFER option when
executing gs, which allows context-dependent attackers to delete
arbitrary files or execute arbitrary commands via a crafted PostScript
- CVE-2015-8107 (arbitrary code execution)
A format string vulnerability in GNU a2ps 4.14 allows remote attackers
to execute arbitrary code.
A remote attacker can send crafted Postscript files which can execute
arbitrary commands or delete files from the system.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security