Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 514
Alerts This Week
Warning Icon 1 514

Debian: DSA-2892-1 Moderate: a2ps Command Execution Risk

debian
Calendar Grey March 31, 2014
Scroller Debian
Tackling weaknesses in c3po, Ubuntu Security Notice USN-4483-1 urges installations to fortify safety and robustness.
Several vulnerabilities have been found in a2ps, an 'Anything to PostScript' converter and pretty-printer
Topics%20covered

Topics Covered

security advisory moderate security issue debian command execution file deletion a2ps

Summary

CVE-2001-1593

The spy_user function which is called when a2ps is invoked with the
--debug flag insecurely used temporary files.

CVE-2014-0466

Brian M. Carlson reported that a2ps's fixps script does not invoke
gs with the -dSAFER option. Consequently executing fixps on a
malicious PostScript file could result in files being deleted or
arbitrary commands being executed with the privileges of the user
running fixps.

For the oldstable distribution (squeeze), these problems have been fixed
in version 1:4.14-1.1+deb6u1.

For the stable distribution (wheezy), these problems have been fixed in
version 1:4.14-1.1+deb7u1.

For the testing distribution (jessie) and the unstable distribution
(sid), these problems will be fixed soon.

We recommend that you upgrade your a2ps packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/



Package: a2ps
CVE ID: CVE-2001-1593 CVE-2014-0466

Topics%20covered

Topics Covered

security advisory moderate security issue debian command execution file deletion a2ps

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.