Lucene search
Gentoo FoundationGLSA-201701-67HistoryJan 29, 2017 - 12:00 a.m.
a2ps: Arbitrary code execution
2017-01-2900:00:00
Gentoo Foundation
security.gentoo.org
32
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
0.004
Percentile
74.4%
Background
a2ps is an Any to PostScript filter.
Description
a2ps’ fixps script does not invoke gs with the -dSAFER option.
Impact
Remote attackers, by enticing a user to process a specially crafted PostScript file, could delete arbitrary files or execute arbitrary code with the privileges of the process.
Workaround
There is no known workaround at this time.
Resolution
All a2ps users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/a2ps-4.14-r5"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | app-text/a2ps | < 4.14-r5 | UNKNOWN |
Related
seebug
seebug
GNU a2ps任意命令执行漏洞
2014-04-14 00:00:00
nessus
nessus
Fedora 19 : a2ps-4.14-23.fc19 (2014-4676)
2014-05-09 00:00:00
GLSA-201701-67 : a2ps: Arbitrary code execution
2017-01-30 00:00:00
Mandriva Linux Security Advisory : a2ps (MDVSA-2014:076)
2014-04-11 00:00:00
nvd
nvd
CVE-2014-0466
2014-04-03 16:15:39
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2014:0581-1)
2021-06-09 00:00:00
Mageia: Security Advisory (MGASA-2014-0161)
2022-01-28 00:00:00
Fedora Update for a2ps FEDORA-2014-4676
2014-05-12 00:00:00
alpinelinux
alpinelinux
CVE-2014-0466
2014-04-03 16:15:00
fedora
fedora
[SECURITY] Fedora 20 Update: a2ps-4.14-23.fc20
2014-05-08 09:58:57
[SECURITY] Fedora 19 Update: a2ps-4.14-23.fc19
2014-05-08 10:18:21
debiancve
debiancve
CVE-2014-0466
2014-04-03 16:15:39
ubuntucve
ubuntucve
CVE-2014-0466
2014-04-03 00:00:00
mageia
mageia
Updated a2ps packages fix CVE-2014-0466
2014-04-04 14:58:23
cve
cve
CVE-2014-0466
2014-04-03 16:15:39
prion
prion
Design/Logic Flaw
2014-04-03 16:15:00
cvelist
cvelist
CVE-2014-0466
2014-04-03 15:00:00
debian
debian
[SECURITY] [DSA 2892-1] a2ps security update
2014-03-31 18:46:17
[SECURITY] [DSA 2892-1] a2ps security update
2014-03-31 18:46:17
osv
osv
a2ps - security update
2014-03-31 00:00:00
a2ps-4.14-6.6 on GA media
2024-06-15 00:00:00
archlinux
archlinux
[ASA-202005-4] a2ps: multiple issues
2020-05-06 00:00:00
securityvulns
securityvulns
a2ps code execution
2014-04-07 00:00:00
[SECURITY] [DSA 2892-1] a2ps security update
2014-04-07 00:00:00
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
0.004
Percentile
74.4%
Related for GLSA-201701-67