Ubuntu 15.10: USN-2862-1 Moderate: Pygments Code Execution Risk

ubuntu

January 7, 2016

Pygments could be made to crash or run programs if it processed a specially crafted font request.

Summary

Pygments could be made to crash or run programs if it processed a specially

crafted font request.

Software Description:

- pygments: syntax highlighting package written in Python

Details:

It was discovered that Pygments incorrectly sanitized strings used to

search system fonts. An attacker could possibly use this issue to execute

arbitrary code.

Topics Covered

security advisory code execution ubuntu python program crash pygments font request

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  python-pygments                 2.0.1+dfsg-1.1svn1.1
  python3-pygments                2.0.1+dfsg-1.1svn1.1

Ubuntu 15.04:
  python-pygments                 2.0.1+dfsg-1svn1.1
  python3-pygments                2.0.1+dfsg-1svn1.1

Ubuntu 14.04 LTS:
  python-pygments                 1.6+dfsg-1ubuntu1.1
  python3-pygments                1.6+dfsg-1ubuntu1.1

Ubuntu 12.04 LTS:
  python-pygments                 1.4+dfsg-2ubuntu0.1
  python3-pygments                1.4+dfsg-2ubuntu0.1

In general, a standard system update will make all the necessary changes.